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A  functional  assembly  becomes  a  subassembly  when  it 
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Tabular  System  Analysis:  An  orderly  procedure  for 
developing  a  functional  organization  of  a  system,  de¬ 
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SECTION  I 


INTRODUCTION 

DEFINITION  OF  THE  PROBLEM 

The  worth  of  a  particular  system  or  piece  of  equipment  is  deter¬ 
mined  primarily  by  the  effectiveness  with  which  it  does  its  job.  Em¬ 
phasis  on  equipment  reliability  alone  does  not  result  in  the  required 
level  of  cost  and  operational  effectiveness.  Other  factors,  such  a's 
system  performance  capability,  operational  reliability,  tactical  avail¬ 
ability  and  cost  must  be  considered.  These  factors  can  be  defined  in 
terms  of  "how  well"  the  equipment  operates,  "how  long"  it  operates, 

"how  often"  it  is  available,  and  "how  economically"  it  can  be  developed, 
manufactured,  and  maintained.  Thus,  effectiveness  (dependability)  is 
the  product  of  reliability  and  availability  for  a  specified  level  of 
performance  and  a  particular  cost. 

One  important  aspect  of  any  equipment  is  its  cost.  Usually,  the 
development  and  design  of  systems  and  equipment  are  made  to  a  required 
specification  at  a  minimum  initial  cost.  However,  an  initial  cost  con¬ 
sideration  neglects  maintenance  expense  of  keeping  the  equipment  working 
satisfactorily  while  in  the  field.  The  cost  of  maintenance  and  repair 
depends  greatly  on  the  initial  reliability  of  the  equipment,  the  more 
reliable  an  equipment  the  less  costly  will  be  the  maintenance  and  re¬ 
pair,  but  the  higher  the  initial  cost. 

In  virtually  every  program  it  is  necessary  to  keep  within  certain 
budget  constraints,  and  the  available  funding  obviously  has  a  major 
impact  on  the  technical  capability  of  the  system  under  development. 

Cost  information  is  an  integral  part  of  decision  making  (particularly 
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cost  to  system  effectiveness  trade-off)  in  all  stages  of  system  de¬ 
velopment.  Thus.,  greater  emphasis  is  given  system  design  to  cost  in¬ 
stead  of  life  cycle  costs  during  the  initial  concept  and  development 
phases  of  an  advanced  development  program. 

This  report  describes  the  tools  and  procedures  available  to  the 
designer  and  program  manager  in  the  development  of  avionic  systems  as 
aids  in  the  trade-off  requirements  and  assets  among  the  key  factors  of 
capability,  reliability,  maintainability,  and  cost. 

The  problem  in  this  study  is  to  bring  into  focus  the  findings  re¬ 
ported  in  Technical  Reports  AFAL-TR-T8-U5  [3]  and  AFAL-TR-135  [lU],  in 
order  to  demonstrate  the  possible  approach  by  applying  the  TASA/DEPEND 
program  to  an  ongoing  program.  This  will  provide  guidelines  to  the 
system  designer  and  program  manager  for  design  approaches,  processes, 
methodology,  and  techniques  to  achieve  desired  SATCOM  system  reliability/ 
availability  in  a  cost-effective  manner.  A  reliability/availability  to 
cost  trade-off  approach  will  be  discussed,  and  it  will  be  based  on  base¬ 
line  costs  as  related  to  system  reliability,  maintainability,  availa¬ 
bility,  and  dependability  for  the  Ka-Band  SATCOM  Set  reported  in  Ref¬ 
erence  lU.  This  approach  will  demonstrate  the  means  for  determining 
the  major  subassembly  contributor  of  system  unreliability.  This  will 
result  in  addressing  those  equipments  which  contribute  the  greatest 
system  undependability  based  on  an  assumed  level  of  maintainability. 
METHOD  OF  ATTACK 

This  paper  addresses  the  following  parameters: 


(l.)  Availability:  Probability  of  being  available  to  send  and/or 
receive  a  message. 

(2.)  Reliability:  Conditional  probability  of  completing  a  message. 

(3.)  Delay:  If  not  available,  or  a  malfunction,  what  the  delay  is  in 
completing  a  message. 

(1*.)  Maintainability:  Time  to  restore  operation,  degraded  or  inoperative. 
(5-)  Cost:  Effect  of  above  requirements  on  acquistion  costs. 

The  technical  approach  uses  a  Tabular  System  Analysis  (TASA) 
technique  to  provide  estimates  of  system  reliability  and  availability 
for  alternative  modes  of  operation.  The  techniques  include  the  develop¬ 
ment  of  a  system  model  organized  in  a  functional  relationship  form  and 
a  computer  program  which  calculates  estimates  of  three  related  quantities 
reliability,  dependability,  and  availability. 

In  addition,  the  results  of  sensitivity  calculations  are  presented 
in  terms  of  a  percentage  contribution  of  each  element  or  subassembly 
state  to  its  unavailability,  unreliability  and  undependability  for  each 
defined  assembly  state.  This  provides  a  rational  basis  for  allocating 
resources  to  achieve  improvements.  Also,  PRICE,  a  computerized  cost 
estimation  program  was  used  for  making  reasonable  cost  estimates.  Thus, 
Battelle  Columbus  Laboratories  (BCL),  as  part  of  Reference  lU,  reported 
on  three  complete  reliability,  availability,  and  dependability  TASA 
analyses  of  the  Ka-Band  SATCOM  Set. 

In  performing  a  TASA  analysis,  the  system  or  equipment  is  divided 
into  a  number  of  functional  blocks,  and  the  dependability,  availability 
and  reliability  of  each  is  estimated.  These  are  based  on  a  defined 
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mission  the  user  desires  to  be  accomplished  in  terms  of  user's  per¬ 
ception  of  system  performance,  reliability,  maintainability  and  cost 
estimates.  In  this  study,  a  hypothetical  10  hour  mission  profile  was 
established,  as  discussed  in  Appendix  A  specifying  2i*0-five  line  for¬ 
ward  link  messages,  720- two  line  report-back  messages,  and  three  hours 
of  conference  links  usage.  All  results  are  expressed  as  the  degree  of 
satisfaction  the  user  could  expect  if  he  were  involved  in  flying  the 
hypothetical  mission. 

PREVIEW  OF  THE  REPORT  CONTENT 

Section  II  briefly  brings  into  focus  the  data  and  findings  re¬ 
ported  in  reference  lU  as  an  application  of  the  TASA/DEPEND  Program 
in  a  follow  on  to  the  system  reliability  assessment  given  in  reference  3 
In  appendices  A,  B,  and  C  the  DEPEND  Program  and  the  TASRA/TASA  Models 
are  discussed. 

Section  III  and  Appendix  D  demonstrates  the  procedures  for  com¬ 
puting  the  percentage  contribution  analysis  capability. 

Section  IV  presents  a  trade-off  analysis  and  the  supporting  Appen¬ 
dix  E  demonstrates  the  minimum  cost  decision  model. 

Section  V  gives  the  major  conclusions  of  the  report  and  some 
recommendations  for  further  considerations. 


SECTION  II 


SYSTEM  AVAILABILITY,  RELIABILITY, 

DEPENDABILITY  AND  COST  ESTIMATES 

INTRODUCTION 

Design  teams  involved  in  the  development  of  major  systems  are 
continually  confronted  with  the  need  to  trade-off  requirements  and 
assets  among  the  key  parameters  of  reliability,  maintainability,  and 
cost.  This  problem  is  faced  in  the  earliest  stages  of  system  concept 
and  design,  and  continues  through  the  various  development  phases  vir¬ 
tually  to  the  point  of  production.  (The  problems  actually  persist 
through  production  and  throughout  the  lifetime  of  the  equipment,  but 
at  a  different  level  of  consideration  because  of  the  inherent  limita¬ 
tions  placed  on  the  options  at  these  later  stages.) 

It  is  during  the  various  development  phases  that  the  greatest 
payoff  can  be  achieved  through  careful  allocation  of  requirements 
and  resources.  The  degree  these  decisions  can  be  controlled  depends 
on  how  complete  the  program  plans  are  at  the  very  beginning  of  the 
system  concept.  If  such  is  the  case,  then  reliability  growth  can  be 
well  tracked  and  controlled,  and  an  early  definition  of  specific  ob¬ 
jectives  can  be  made  and  .met.  But  frequently  the  "ility"  efforts  and 
even  realistic  cost  considerations  come  into  play  somewhat  later  after 
the  system  is  already  pretty  well-defined.  Then  the  problem  becomes 
one  of  setting  reliability  and  maintainability  goals  to  achieve  the 
desired  objectives  of  the  system  within  an  acceptable  cost  range .  Fre¬ 
quently  the  objectives  are  not  clear  and  have  not  been  truly  derived 
from  tiie  overall  mission  requirements  of  the  system.  The  key  then 
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becomes  not  only  one  of  how  to  establish  appropriate  requirements  and 
perform  rigorous,  meaningful  trade-off  analyses  between  reliability, 
maintainability,  and  cost,  but  also  clarifying  the  goals  after  the 
project  has  reached  the  breadboard  stages  and  establishing  the  method¬ 
ology  for  obtaining  these  goals.  Thus,  this  report  discusses  such 
an  approach  for  assessing  system  reliability  and  availability  in  re¬ 
lationship  to  system  performance  and  cost. 

APPROACH  TO  SYSTEM  ESTIMATES 

One  of  the  initial,  goals  of  the  computations  performed  in  this  re¬ 
port  is  the  generation  of  availability,  reliability,  maintainability 
and  dependability  estimates  of  the  Ka-Band  SATCOM  Set  for  a  typical 
tactical  mission.  Before  estimates  could  be  prepared,  it  was  necessary 
to  determine  the  duration  of  this  typical  mission,  and  to  establish 
the  extent  to  which  the  various  functions  of  the  system  would  be  used 
during  such  a  mission.  In  short,  it  was  necessary  to  establish  a  mis¬ 
sion  profile.  Further,  after  the  mission  profile  had  been  established, 
it  was  necessary  to  incorporate  this  into  the  analytical  model  in  such 

a  way  that  effective  use  could  be  made  of  the  information,  while  at 
the  same  time  allowing  flexibility.  Changing  tactical  requirements  or 
modified  equipment  capabilities  could  easily  alter  the  mission  profile. 
The  following  describes  the  mission  hypothesized  for  the  system  estimates 
in  this  report  and  as  given  in  reference  l4  by  Battelle. 

The  actual  estimates  of  the  interrelated  quantities  of  reliability, 
dependability,  and  availability  were  obtained,  with  the  DEPEND  program. 
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in  a  series  of  calculations  that  provided  values  for  all  three 
essentially  simultaneously  (Appendix  A).  However,  cost  estimates 
are  addressed  separately,  based  on  the  RCA/PRICE  MODEL  applied  by 
Battelle  [l^].  The  first  three  items  are  presented  in  sequential  sec¬ 
tions  following  the  mission  profile  discussion,  but  are  discussed 
from  a  conceptual  viewpoint  in  this  section.  The  reader  interested 
in  a  more  mathematical  presentation  is  referred  to  Appendix  B. 

MISSION  PROFILE 

A  typical  mission  duration  of  ten  hours  was  selected  (Figure  1) . 
This  is  based  on  an  eight  hours  "on-station"  period  plus  an  hour  of 
operation  prior  to  and  an  hour  of  operation  subsequent  to  the  on-station 
period.  These  additional  two  hours  are  used  for  system  start-up,  data 
transfer,  and  shut-down. 

To  illustrate,  let  us  suppose  that  Command  Posts  A,  B,  and  C  are 
to  provide  the  command  function  for  one  twenty-four  hour  period,  as 
shown  in  Figure  2.  During  the  first  hour  of  operation  CP-B  will  accomp¬ 
lish  system  initialization  and  checkout,  and  will  accept  data  from  CP-A 
which  is  currently  on-station.  These  data  include  any  messages  that, 
for  any  reason,  CP-A  has  been  unable  to  transmit. 

During  the  following  eight  hours  CP-B  will  be  on-station  providing 
the  command  function.  In  the  last  hour  of  this  eight  hour  period,  CP-8 
will  also  transfer  any  necessary  data  and  untransmitted  messages  to  CP-C. 
At  the  end  of  the  eight  hours  CP-C  comes  on-station,  providing  the  com¬ 
mand  function.  Finally,  CP-B  will  have  an  additional  hour  in  which  to 
complete  the  transfer  of  data  to  CP-C  if  this  has  not  been  accomplished, 
to  shut  down  equipment,  and  return  to  base.  . > 
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Figure  1  MISSION  PROFILE 
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Initialization  and  System  Check  Out 


Receive  Data  from  Prior  Command  Post 


On  Station 


Transmit  Data  to  Subsequent  Command  Post 


Return  to  Base  and  Land 


FIGURE  2.  COMMAND  POST  (CP)  MISSION  OUTLINE 


This,  then,  represents  the  general  outline  of  a  hypothetical  mission. 
To  complete  the  mission  profile  required  for  computations,  it  is  also  nec¬ 
essary  to  determine  the  extent  to  which  the  various  capabilities  provided 
by  the  equipment  will  be  used. 

MISSION  SUBSETS 

To  accomodate  changes  in  mission  or  equipment,  estimates  were  prepared 
for  three  different  subsets  of  the  mission  profile.  Each  profile  subset 
is  based  on  the  typical  mission  described  above.  The  first  mission  subset 
consists  of  a  "mission"  in  which  only  the  forward  link  capability  is  used. 
In  the  second  profile  subset  only  the  report-back  link  is  used,  and  in  the 
third  profile  subset  only  the  conference  link  is  used,  A  fourth  mission, 
based  on  the  overall  profile  definition,  actually  incorporates  all  three  of 
the  subsets  as  one  integrated  mission  in  which  the  entire  Ka-Band  SATCOM 
Set  capabilities  are  used. 

This  approach  provides  great  flexibility.  If  at  a  later  time  the 
mission  is  redefined  so  that,  for  example,  the  conference  link  is  util¬ 
ized  more  heavily  than  assumed  in  this  analysis,  while  the  forward  link 
is  used  less,  these  changes  can  be  readily  accomodated.  Equipment  changes 
will  require  revision  only  of  the  data  pertinent  to  the  functions  affected 
by  the  changes. 

Forward  Link  "Mission"  Subset.  In  considering  a  mission  in  which  only 
the  forward  link  is  used,  it  was  assumed  that: 

1.  Thirty  messages  would  be  sent  every  hour,  on  the 
average,  during  the  eight  hour  on  station  period. 

2.  Each  message  would  consist  of  five  lines,  and  each  line 
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would  require  one  cycle  of  4.2  seconds  transmission 
time. 

3.  Verification  would  be  concurrent  with  message 
transmission,  except  for  a  4.2  second  offset. 

See  Functional  Diagram,  Figure  3- 

These  figures  result  in  a  mission  in  which  240  messages,  consisting  of 
a  total  of  1200  transmission  cycles,  are  sent. 

Report-Back  "Mission"  Subset.  The  mission  in  which  only  the  report-back 
link  is  used  is  defined  as  consisting  of: 

1.  Ninety  messages  per  hour,  on  the  average,  for  the 
eight  hour  on-station  period. 

2.  Two  lines  per  message,  at  6.3  seconds  per  line. 

The  additional  time  per  line  is  used  for  a  preamble. 

Thus  the  report-back  link  mission  includes  a  total  of  720  messages  of  two 
lines,  each  requiring  6.3  seconds.  Special  consideration  must  be  given 
to  the  fact  that  numerous  poruions  of  the  system  are  common  to  two  or 
three  links.  Therefore,  in  apportioning  reliability,  MTTRs,  etc.  among 
these  links  it  is  convenient,  for  computational  purposes,  to  divide  the 
operation  of  the  various  functions  into  increments  of  4.2  seconds.  The  720 
messages  received  during  the  renort-back-1 ink-only  mission  represent  2l6o 

cycles  of  4.2  seconds  each.  See  Functional  Diagram  Figure  4. 

Conference  Link  "Mission"  Subset.  The  conference-link-only  mission 

consists  of: 

1.  Fifteen  minutes  of  conference  per  hour,  on  the  average, 
during  the  eight-hour  on-station  period. 

2.  An  additional  hour  of  conference  link  activity,  to 
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Source j  AFAL-TR-78-I35 


FIGURE  3.  KA-BAND  SATCOM  SET  FORWARD  LINK  FUNCTIONAL  DIAGRAM 


Source j  AFAL-TR-78-I35 


FIGURE  It.  KA-BAND  SATCOM  SET  REPORT-BACK  LINK  FUNCTIONAL  DIAGRAM 


transfer  data  from  the  prior  command  post  and  to 


the  subsequent  command  post. 

The  conference-link-only  mission  therefore  consists  of  a  total  of  three 
hours  of  operation,  or  2571  cycles  of  U.2  seconds  each  (Functional  Dia¬ 
gram,  Figure  5)- 

Total  System  Mission.  The  total  mission  estimates  for  the  entire  Ka- 
Band  SATCOM  Set  include  all  the  messages  of  all  three  missions  described 
above.  From  the  standpoint  of  activity,  the  mission  profile  which  con¬ 
siders  the  entire  Ka-Band  SATCOM  Set  is  an  integrated  total  of  the 
three  previous  missions;  but,  of  course,  the  mission  duration  remains 
at  ten  hours.  When  the  three  one-link  mission  subsets  are  combined, 
their  availabilities,  dependabilities,  and  maintainabilities  interact. 

A  failure  of  a  common  element,  for  example,  will  constitute  a  failure 
of  all  links  that  , it  serves,  whereas  a  failure  of  a  unique  element  will 
only  affect  its  particular  link.  Because  of  such  interactions,  the 
availability  of  the  Ka-Band  SATCOM  Set,  for  example,  is  not  calculated 
from  the  availabilities  calculated  for  its  three  links  individually, 
but  instead  is  re-calculated  by  rolling  up  reliability  and  maintainability 
from  the  basic  building  blocks  of  the  system  (Functional  Diagram, 

Figure  6). 


I1* 


Source j  AFAL-TR- 78-135  ka-bano 

SATCOM  SET 
(CONF  LINK) 


FIGURE  5-  KA-BAND  SATCOM  SET  CONFERENCE  LINK  FUNCTIONAL  DIAGRAM 


Source:  AFAL-TR-78-I35 


SYSTEM  DESCRIPTION 


EHF  SATCOM  SET .  The  EHF  SATCOM  Set,  under  consideration  in  this  demon¬ 
stration,  was  installed  in  a  l*950th  Flight  Test  Wing  C-135  test  aircraft 
(Tail  Nr.  662).  A  simplified  block  design  of  the  SATCOM  hardware  and 
a  pictorial  view  of  the  aircraft  installation  are  shown  in  Figures  7  and 
8  respectively  (Reference  l).  The  airborne  SATCOM  Terminal  (AN/ASC-22) 
consists  of  a  1000  watt  millimeter  wave  transmitter,  a  low  noise  receiving 
system,  a  modulator  and  demodulator  (MODEM),  and  input  and  output  devices, 
as  discussed  in  reference  3. 

PREDICTION  MODEL.  The  prediction  model  for  the  Ka-Band  SATCOM  System 
is  organized  with  respect  to  the  functions  to  be  performed;  that  is, 
communication  by  forward  link,  conference  link,  and  report-back  link. 

In  addition  to  the  individual  functions  of  forward,  conference  and  re- 
port-back  links  of  the  Ka-Band  Set  there  have  been  identified  three 
"common"  functions;  these  are,  functional  groupings  of  the  equipment 
that  influence  two  or  three  links.  The  common  function  includes  all 
of  the  hardware  that  can  cause  failure  or  degradation  of  all  three 
communication  links.  The  forward  and  conference  common  function  in¬ 
cludes  the  hardware  that  can  degrade  or  cause  failure  of  these  links 
without  affecting  the  report-back  link.  The  conference  and  report-back 
common  function  includes  the  hardware  that  can  cause  degradation  or 
failure  of  these  links  without  affecting  forward  link  operation.  The 
functional  tree  diagram  of  this  organization  is  shown  in  Figure  9. 

Each  hardware  element  and  element  grouping  used  in  the  analysis 
is  identified  by  a  numeric  index.  Each  box  in  the  functional  tree 
diagram  in  Figure  3  and  subsequent  figures  includes  a  numeric  index  in 
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FIGURE  7  AC  Cl 35/662  SIMPLIFIED  BLOCK  DIAGRAM 


FIGURE  9.  KA-BAND  SATCOM  SET  COMMON  FUNCTIONAL  DIAGRAM 


the  lower  left  Corner.  The  element  and  grouping  identification  cor¬ 
responding  to  each  index  number  used  are  tabulated  together  with  the 
corresponding  malfunction  states  in  Appendix  A. 

Figures  3,  H,  and  5  show  the  functional  tree  diagrams  for  the 
SATCOM  Terminal  forward,  report-back  and  conference  link,  respectively. 
Both  individual  and  common  functions  of  the  Ka-Band  Set  are  included. 

Prior  to  operating  the  system,  an  initialization  is  necessary.  The 
functional  diagram  relating  to  initialization  is  shown  in  Figure  10. 

The  Ka-Band  SATCOM  Set  common  functions  as  shown  in  Figure  9  are  a 
truncated  version  of  that,  shown  in  Figures  10,  11,  12,  13,  and  lh  of 
Report  AFAL-TR-T8-135 »  Part  I,  Volume  I  [ l4 ] .  From  the  hardware  view¬ 
point,  the  two  major  equipment  groupings  of  the  Ka-Band  SATCOM  Set 
are  the  Ka-Band  Modem  Group  and  the  Communications  Terminal  Group. 
ESTIMATING  CONCEPTS  AMD  PROCEDURES 

Reliability  Estimates.  The  reliability  (R)  estimates  for  the  ADM  sys¬ 
tem  under  study  have  been  prepared,  using  the  TASA  (Tabular  System 
Analysis)  technique.  This  technique  can  accommodate  failures,  i.e., 
conditions  that  prevent  system  operation,  as  well  as  malfunctions,  in 
which  only  a  portion  of  the  system  is  inoperative.  If  a  malfunction 
occurs,  the  system  may  operate  at  a  reduced  power  output  with  fewer 
options  as  to  operating  mode  or  frequency,  etc..  Nevertheless,  some 
form  of  communication  will  be  possible.  Thus,  TASA  simulates  real  con¬ 
ditions  more  accurately  than  many  other  system  reliability  models. 

Prediction  of  system  performance  using  TASA  is  made  by  dividing 
the  system  into  functional  blocks  as  described  in  reference  lU.  This 
was  accomplished  for  the  existing  (ADM)  system  by  obtaining  lists 
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of  black  boxes 


up  the  system.  The  equipment  manufacturers  cooperated  in  providing  re> 


liability  estimates  for  each  black  box,  usually  calculated  using  the 


methods  of  MIL-HDBK-217B  [23].  The  effects  of  failure  of  each  black  box  on 
system  performance  were  then  evaluated,  again  with  the  help  of  the  equip¬ 


ment  manufacturers.  The  black  boxes  serve  as  the  basic  building  blocks 
(functional  elements)  of  the  system  as  it  is  "assembled"  in  the  computer' 


ized  TASA  model 


yields  a  tabulation  of  the  functional  contribution  of  each  functional 


element  comprising  the  Ka-Band  SATCOM  Set  and  makes  it  possible  to  as 


sign  reliability  values  to  these  elements.  The  possible  functional  states 


of  each  element,  including  the  various  modes  in  which  it  might  fail  and 


the  consequences  of  failure  (i.e.  catastrophic  or  any  of  a  number  of 


degraded  modes),  are  determined.  The  "ilities"  of  the  functional  ele¬ 


ments  are  then  combined  to  obtain  the  "ilities"  of  larger  functional  en¬ 


tities  and  ultimately  the  entire  Ka-Band  SATCOM  Set,  as  described  in  the 


subsequent  Estimate  Roll-Up  Section  of  this  report.  A  discussion  of  the 


derivation  of  this  technique  is  given  in 


and  in  Appendix  A  of  this  report 


Maintainability  Predictions.  The  basic  functional  elements  used  in 


system  maintainability.  The  maintainability  predictions  require  infor¬ 
mation  on  the  MTTR,  (mean  time  to  restore)  needed  to  restore  the  operation 


of  any  element  after  a  failure  has  occurred.  Only  maintenance  that  would 


be  performed  in  flight,  or  while  the  equipment  is  in  use,  is  considered 


in  this  analysis.  In  some  cases,  an  alternative  mode  of  operation  may 


be  selected  which  circumvents  the  failed  element.  If  this  represents 
a  satisfactory  method  for  transmitting  or  receiving  the  message,  the 
time  to  establish  this  alternative  mode  of  operation  is  the  MTTR  used  for 
that  element. 

Realistic  estimates  of  the  average  mean  restoration  time  (ATTR)  of 
the  system  was  based  on  information  sought  from  the  technicians  who  per¬ 
formed  maintenance  on  the  existing  ADM  hardware.  This  data  was  reported 
in  reference  lH  by  BCL.  From  this  source  of  information  the  MTTR  for 
failures  in  each  basic  functional  building  block  in  the  system  was  estab¬ 
lished. 

The  MTTRs  of  the  functional  elements  are  accummulated  in  order  to 
determine  the  ATTRs  (average  time  to  restore)  of  larger  functional 
entities  and  of  the  entire  Ka-Band  SATCOM  system. 

Availability  and  Dependability  Estimates.  Availability  (A)  is  the  prob¬ 
ability  that  a  specified  function  is  in  its  normal  operating  state  at 
a  specified  time,  or  that  an  acceptable  alternative  mode  of  operation 
can  be  provided.  If  the  user  decides  that  he  wants  to  send  a  message 
immediately,  availability  is  the  probability  that  he  will  find  the  Ka- 
Band  SATCOM  Set  in  an  operational  condition  at  that  time.  Availability 
is  a  function  of  equipment  reliability  or  its  average  time  between 
failures  or  malfunctions  (ATBO)  and  the  average  time  needed  to  restore 
the  equipment  to  normal  operation  or  to  provide  an  alternative  ac¬ 
ceptable  mode  of  operation  (ATTR).  If  the  equipment  exhibits  a  long 
ATtMJ  and  a  short  ATTR,  the  probability  of  finding  it  in  the  normal 
operational  state  will  be  high.  On  the  other  hand,  if  its  ATBO  is 
short,  and  its  ATTR  is  high,  we  would  expect  to  find  it  in  a  nonoperating 
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state  much  of  the  time.  Availability  is  also  a  function  of  mission 
duration  and  number  of  messages  anticipated  during  the  mission.  These 
factors  determine  the  amount  of  standby  time  between  messages. 

System  dependability  (D)  is  defined  as  the  probability  that  a 
specified  number  of  communications  can  be  begun  and  completed  without 
a  system  malfunction  or  failure.  The  dependability  is  the  probability 
that  all  the  communications  required  for  a  specified  mission  duration 
will  be  completed  without  an  equipment  failure  that  results  in  a  delay. 
Thus,  associated  with  the  dependability  prediction  is  an  estimate  of 
communication  delay  which  ’‘gives  the  average  length  of  delay  attributable 
to  equipment  failure  that  the  user  may  expect  if  a  failure  or  mal¬ 
function  occurs. 

Estimate  Roll-Ups.  As  noted  earlier,  although  reliability,  dependability, 
and  availability  have  been  discussed  in  a  sequential  order,  the  computer 
program  used  actually  calculates  all  three  of  these  quantities  at  essen¬ 
tially  the  same  time.  As  discussed  by  Drennan  of  Battalle  in  reference 
lU ,  the  SATCOM  SET  was  first  divided  into  a  number  of  "black  boxes",  or 
basic  functional  building  blocks  (elements).  Reliability  figures  for 
each  element  were  established  (data  from  equipment  manufacturers),  and 
the  mean  restoration  time  (MTTR)  of  the  system  for  specified  failures 
or  malfunctions  of  each  element  was  established. 

The  computer  calculates  the  availability  (A)  and  dependability  (D) 
of  each  functional  element.  It  then  combines  these  data  for  the  elements 
into  larger  functional  assemblies  and  combines  these,  in  turn,  into  still 
larger  assemblies,  continuing  this  process  until  the  last  functional 
assembly  of  SATCOM  Set  is  reached.  At  each  level  and  for  each  functional 
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block  the  availability,  reliability,  dependability,  and  maintainability 
are  calculated,  using  the  TASA  approach  briefly  discussed  in  Appendices 


There  is  one  additional  consideration  required  for  maintainability 


since  weighted  averages  are  used  rather  than  simple  arithmetic  averages 


As  the  maintainabilities  are  calculated  for  the  larger  functional  as 


semblies,  they  are  ex-pressed  as  the  weighted  average  restoration  time 


( ATTR ) •  The  ATTR  differs  from  the  MTTR  in  that  the  ATTR  includes 


weighting  factors  relating  to  the  dependabilities  of  the  various  basic 


building  blocks  comprising  the  particular  function.  Thus,  in  calculating 


the  ATTR  of  the  higher  level  functional  assemblies,  the  MTTRs  of  the  ele^ 


ments  are  weighted  according  to  their  dependabilities  (the  probabilities 
that  they  will  require  a  repair  action).  This  is  necessary  so  that  the 


ATTRs  may  represent  a  realistic  average  time  to  restore  operation  of  a 


major  function  or  of  the  entire  SATCOM  Set,  as  discussed  by  Drennan  in 


SYSTEM  "ARD"  ESTIMATES 


In  performing  the  availability/dependability,  reliability,  and  maiu 


tainability  analyses  for  the  Ka-Band  SATCOM  Set,  estimates  were  generated 


based  on  functional  elements  composed  of  specified  hardware.  These 


were  then  rolled  up  to  obtain  estimates  of  the  three  major  functional 


assemblies  or  links  comprising  the  system.  At  this  level,  estimates 


for  different  mission  profiles  were  prepared  and  combined  until  esti 


mates  for  the  entire  Ka-Band  SATCOM  Set  were  obtained  for  a  typical 


mission.  Table  1  lists  the  Ka-Band  SATCOM  Set  and  its  functional  states 


for  RUN  ONE  and  provides  the  appropriate  estimates  generated  for  them 


For  each  malfunction  or  failure  mode,  values  for  availabil 


ity/ dependability,  maintainability  (mean  time  to  restore),  and  relia¬ 


bility  are  given 


The  availability  values  listed  in  Tables  1  and  2  for  RUN  ONE  give 


the  probability  that  the  Ka-Band  SATCOM  Set  will  be  operational  at  the 


time  the  user  of  the  equipment  needs  to  send  or  receive  a  message,  pro¬ 


vided  that  the  particular  functional  state  that  is  identified  can  be 


tolerated.  The  concept  of  availability  allows  for  inclusion  of  the  pos 


sibility  that  if,  for  example,  the  mode  of  message  transmission  first 


selected  is  not  functional,  an  alternative  transmission  mode  could  be 


selected;  so  that  a  means  of  message  transmission  may  be  immediately 


available  even  if  the  equipment  were  not  completely  operational.  The 


bar  graphs  in  Figure  11  give  availability  values  at  selected  levels  of 


MTBF  for  Elements  E35  and  E8l 


In  Table  3  and  Table  i+,  RUNS  ONE  through  SEVEN  show  that  the  MTBF 


for  Elements  E35  and  E8l  was  varied  from  a  base  of  1.0  to  three  times 


the  original  value.  However,  in  RUN  EIGHT,  the  MTBF  was  set  to  the  base 


value  and  the  MTTR  was  set  to  one  hour  for  E35  and  E8l.  Expected  mal 


function  values  are  listed  for  the  designated  element,  subassembly,  as 


sembly,  subsystem  and  system.  The  ATBO  is  also  given  for  Assembly  38 


showing  that  as  the  MTBFs  for  the  elemental  levels  are  increased,  the 


since  the  ATBO  for  As 


sembly  38  also  includes  other  elements  of  the  system.  The  bar  graph 


TABLE  2  Estimated  Values  of  Availability  (AV),  Reliability  (RE),  Dependability  (DE) 

for  the  Ka-Band  SATCOM  Set  Mission  using  only  One  Link. 


MPMRn 


TABLE  3*  Expected  Malfunctions  at  Selected  Levels  of  MTBF  for  Elements  E35  and  E8l 


Malfunctions  per  10,000  Hours  of  Operation 


for  availability  values  at  selected  levels  of  MTBF  and  MTTR  for  Ele 


ments  E35  and  E8l,  in  Figure  11  shows  a  slight  increase  in  availability 


for  TASA  Nr.  2,  TASA  Nr.  6  (FWD)  and  TASA  Nr.  8  (CONF).  No  change  in 


the  total  system  availability  for  TASA  Nr.  7  (R/B)  was  depicted  because 


no  transmitter  (E35  and  E8l)  was  involved.  Figure  12  depicts  changes 


in  ATBO,  Availability  and  Malfunction  values  for  Assembly  38  in  rela¬ 


tionship  to  changes  in  MTBF  for  Elements  35  and  8l 


SYSTEM  COST  ESTIMATES 


In  most  programs  it  is  necessary  to  operate  within  certain  mone 


tary  constraints,  and  the  available  funding  obviously  has  major  impact 


Information 


on  costing  is  needed  so  that  intelligent  decisions  may  be  made  in  order 


to  obtain  satisfactory  equipment  at  an  acceptable  cost 


The  Avionics  Laboratory  had  access  to  the  PRICE  costing  model  de 


veloped  by  RCA,  (Reference  lU).  The  model,  stored  in  a  computer,  can 


estimate  the  cost  of  a  variety  of  items,  including  airborne  electronic 


equipment.  To  obtain  the  cost  estimate,  the  values  for  the  system  non 


performance  parameters  were  inputed  into  the  model.  These  included  such 


items  as  weight,  volume,  parts  count  and  power  dissipation.  The  PRICE 


model  does  not  accept  performance  parameters  such  as  power  output,  fre 


quency  stability,  receiver  sensitivity,  and  reliability  in  a  direct,  dis 


crete  manner.  However,  the  PRICE  model  includes  a  memory  bank  in  which 


is  stored  nonperformance  parametric  information  for  (l)  equipment  similar 
to  that  under  study,  (2)  cost  information  on  this  similar  (that  is,  re- 


latable)  equipment,  and  (3)  equations  or  algorithms  that  establish  rela¬ 


tionships  between  the  various  parameters  and  cost,  were  largely  developed 


Figure  11  Bar  Graph  of  Availability  Values  at  selected  levels  of 
MTBF  for  Elements  E35  and  E8l. 


ATBO  —  HOURS 


©s  RUN  EI6HT 


as  the  result  of  past  experience.  The  computer  compares  the  parameters 
of  the  new  equipment  with  those  of  the  equipment  in  its  memory  hank 
applies  the  proper  algorithms,  and  thus  determines  an  estimated  cost 
for  the  equipment  under  study.  Practical  results  have  been  obtained 
by  other  Air  Force  users  of  the  PRICE  model,  sometimes  within  10  percent 
of  the  actual  cost. 

Battelle,  as  reported  in  AFAL-TR-78-135 ,  separated  the  Ka-Band 
equipment  under  test  into  functional  boxes,  permitting  characterization 
of  individual  system  performance  modes  [lU].  Although  the  PRICE  model 
analyzed  equipment  only  as  blocks  of  hardware,  the  various  hardware  sub¬ 
systems  can  be  gathered  into  these  same  functional  groupings.  Table  5 
lists  some  of  the  major  contributors  to  system  unreliability  in  terms 
of  percentage  contribution  to  system  cost. 

Cost  estimates  for  the  Ka-Band  SATCOM  Set  and  for  assemblies  making 
up  the  set  were  prepared  using  the  PRICE  model  approach  described  in  a 
previous  section  and  in  Reference  l4.  Problem  boxes  were  identified  by 
the  methods  discussed  in  Chapter  3  and  Appendix  D  as  those  subsystem 
units  which  were  most  likely  to  fail.  Particular  attention  was  given 
to  these  boxes  to  determine  the  cost  effect  of  increases  in  their  MTBFs. 
These  results  are  shown  in  Figure  13  which  gives  the  cost-MTBF  relation¬ 
ships  for  these  components.  Trade  off  analysis  using  these  results  will 
be  prepared  by  the  methods  discussed  in  Section  IV  and  Appendix  E. 
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TABLE  -1  CONTRIBUTION  TO  SYSTEM  COST 

Percentage 

Identification  System  Cost 


Self  Test  Unit  7.3 
Report-Back  Demodulator  6.5 
Message  Processor  6.1 
Sync/Demux  Control  5.6 
Code  Generator  4,9 
Low  Noise  Amplifier  4.6 
Forward/Report-Back  De interleaver/Decoder  3.7 
Nigh  Voltage  Power  Supply  3.7 
High  Power  Amplifier  3.7 
Conferencing  Demodulator/Decoder  3.1 
Ka-Band  Modem  Control  Panel  3.1 
Modulator  2.9 
Antenna  Pointing  Electronics  2.7 

Source*  AFAL-TR-78-I35 
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SECTION  III 


PERCENTAGE  CONTRIBUTION  OF  AN  ELEMENT  TO  THE  TOTAL  SYSTEM 


When  the  relative  importance  ranking  procedure  described  in  Appendix 
D  of  this  report  is  applied  to  the  functional  hierarchy  of  the  ADM  Ka- 
Band  SATCOM  Set  (TASA  Nr.  2),  the  results  given  in  Table  6  and  Figures 
l4  and  15  are  obtained.  These  bargraphs  and  tables  indicate  that  the 
percentage  contribution,  as  related  to  unavailability,  unreliability  and 
undependability  for  two  functional  subassemblies,  accounted  for  more  than 
h0%  of  the  observed  total  of  lU  subassemblies.  Thus,  the  Terminal 
Transmission  Subassembly  (TASA  35-81)  is  the  most  significant  contri¬ 
butor  as  related  to  unavailability  while  the  MODEM  common  functions 
(TASA  108)  ranked  second. 


INTRODUCTION 

The  DEPEND  Program,  as  described  in  Section  II,  has  a  unique  capa¬ 
bility  for  tabulating  the  values  of  a  subassembly  sensitivity  to  an  as¬ 
sembly  -  in  terms  of  percentage  contribution  of  each  element  or  subassem¬ 
bly  state  -  to  the  unavailability,  unreliability  and  undependability  of 

each  defined  assembly  state.  An  example  is  given  in  Figures  lU  and  15. 
Thus,  the  relative  importance  of  each  element  or  subassembly  state 

to  the  malfunctioning  or  failure  of  the  assembly  can  be  observed.  This 
provides  a  rational  basis  for  allocating  resources  to  achieve  improvement 
of  the  assembly  reliability  and/or  maintainability  and  a  basis  for 
specifying  "ility"  requirements  for  the  element  and  subassembly  to  assure 

that  the  assembly  meets  the  "ility"  goals. 

TASA  NR.  2  -  TOTAL  SYSTEM  PERCENTAGE  CONTRIBUTION 


lajvaa  wS'Lsas  ox  Mou.naia1LNoo..aovj,Maoa5r.ci 


TASA  NR.'s  35  and  8l  PERCENTAGE  CONTRIBUTIONS  AT  SELECTED  RUNS 


The  MTBF  and  MTTR  for  Elements  35  and  8l  were  varied  in  the  manner 
discussed  in  Section  II.  Table  11  is  a  compilation  of  the  results  given 
in  Tables  7  through  10.  RUNS  FIVE,  SEVEN,  and  EIGHT  data  show  that  the 
total  percentage  contribution  in  terms  of  unavailability  for  Elements  35 
and  8l  to  TASA  Nr.  2  is  reduced  when  compared  to  RUN  ONE  data.  This 
would  indicate  an  improvement  in  either  MTBF  or  MTTR.  However,  cost  will 
be  addressed  in  the  next  Section  in  terms  of  trade-offs  to  determine  the 
most  economical  alternatives  based  on  selected  runs  in  relationship  to 
a  specified  availability  as  a  goal. 

SUMMARY  AND  CONCLUSIONS 

A  primary  goal  of  the  procedure  for  relative  importance  ranking  of 
each  element  to  the  malfunction  or  failure  of  the  assembly  was  to  iden¬ 
tify  the  functional  assemblies  of  the  Ka-Band  SATCOM  Set  that  have  the 
greatest  influence  on  the  system  "ilities."  The  results  of  these  studies 
are  described  in  Appendix  D.  The  studies  used  the  sensitivity  tabula¬ 
tions  printed  by  the  DEPEND  Program.  These  tabulations  are  given  in 
Appendix  D. 

Thus  a  capability  was  demonstrated  that  can  be  used  to  determine 
which  element  could  have  the  greatest  influence  on  system  "ilities"  in 
terms  of  various  alternatives  for  a  trade-off  between  cost  and  improved 
performance.  Improved  performance  could  include  reliability  improvement 
as  a  result  of  redundancy,  derating,  or  redesign  and  maintainability 
improvement  which  could  otherwise  require  increased  training,  spares  and 
accessibility. 
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TABLE  _]_  PERCENTAGE  CONTRIBUTION 

SUBASSEMBLY  TO  SYSTEM  RUN  0NE 

X  UNAVAILABILITY  UNRELIABILITY  UNDEPENDABILITY 


%  Assy 

State-Sys 

A 

Assy  ID 

B 

%  Assy 
State 

C 

Sys  ID 

D 

Number  of 
Subassy 
E 

Subassy 

ID 

E* 

^Subassy 

State 

A* 

^Subassy 
to  Sys 

24.6 

208.6 

12.7 

2.6 

1 

204.7 

10.9 

21.1 

21.1 

204.7 

33.5 

1 

200.7 

33-^ 

21.1 

21.1 

200.7 

36.7 

1 

39.6 

28.1 

16.1 

16.1 

39.6 

35.2 

1 

38.6 

35-1 

16.1 

16.1 

38.6 

40.5 

1 

e35.2 

35-0 

13.9 

l6.1 

38.6 

40.5 

1 

E35-3 

5.4 

2.1 

16.8 

208.4 

13.8 

mu 

1 

204.5 

12.9 

15.7 

15.7 

204.5 

23.5 

1 

200.5 

23.4 

15.6 

15.6 

200.5 

25.8 

1 

39.5 

20.8 

12.6 

12.6 

39.5 

26.0 

1 

38.5 

26.0 

12.6 

12.6 

38.5 

30.1 

1 

e  35.1 

8.2 

3-4 

12.6 

38.5 

30.1 

1 

E  81 .1 

21.9 

9.2 

| 

24.8 

208.1 

24.3 

1 

204.1 

22.8 

23.3 

23.3 

204.1 

3^.7 

1 

200.1 

25.7 

17.2 

17.2 

200.1 

28.3 

1 

39.1 

23.6 

14.4 

14.4 

39.1 

29.6 

1 

40.1 

12.8 

6.2 

14.4 

39.1 

29.6 

1 

38.1 

16.6 

8.1 

8.1 

38.1 

19.3 

1 

E  31.1 

IB 

1.8 

8.1 

38.1 

19.3 

1 

E  32.1 

7.8 

BMI 

8.1 

38.1 

19.3 

1 

E  33.1 

7.2 

3.0 

TABLE 


%  Assy- 
State -Sys 
A 


18.7 


15.2 


15.1 


9. 


9. 


9. 


6  PERCENTAGE  CONTRIBUTION 

SUBASSEMBLY  TO  SYSTEM 
X  UNAVAILABILITY  _  UNRELIABILITY 


Sys  ID 


12.0 


11.1 


11.0 


7.5 


•  5 


.5 


Assy  ID 

%  Assy 
State 

B 

C 

208.6 

9.5 

204.7 

26 . 6 

200.7 

30.0 

39-6 

25.3 

38.6 

31.3 

38.6 

31.3 

208.4 

10.7 

204.5 

18.0 

200.5 

20.3 

39.5 

18.1 

38.5 

23.2 

38.5 

23.2 

RUN  FIVE 
UNDEPENDABILITY 


%S 


29.8 

208.1 

27.9 

204.1 

20.8 

200.1 

17.4 

39.1 

17.4 

39.1 

9.8 

38.1 

9.8 

38.1 

..  . 

9.8 

38.1 

26.6 


44.7 


37.5 


42.6 


42.6 


29.8 


29.8 


29.8 


204.5 

9.9 

200.5 

17.9 

39-5 

13.8 

38.5 

18.8 

E  35.1 

6.3 

E  61 -1 

16.9 

204.1 


200.1 


39.1 


40.1 


38.1 


.  31.1 


25.1 


33.3 


31.4 


18.4 


24.1 


11.1 


11.0 


27.9 


20.8 


TABLE 


X  UNAVAILABILITY 


PERCENTAGE  CONTRIBUTION 
SUBASSEMBLY  TO  SYSTEM 
TY  UNRELIABILITY 


RUN  SEVEN 
UNDEPENDABILITY 


%  Assy 
State-Sys 
A 

Assy  ID 

B 

16.0 

208.6 

12.5 

204.7 

12.5 

200.7 

6.5 

39.6 

6.5 

38.6 

6.5 

38.6 

8.3 


23-3 


26 . 6 


19.8 


25.5 


25.5 


Sys  ID  Number  of  Subassy 
Subassy  ID 
D  E  Et 


31.9 

208.1 

27.5 

30.0 

204.1 

49.4 

22.4 

200.1 

42.1 

18.8 

39.1 

49.9 

18.8 

39.1 

49.9 

10.7 

38.1 

36.4 

10.7 

38.1 

36.4 

10.7 

38.1 

36.4 

204.1 

25.9 

200.1 

36.9 

39.1 

35.2 

40.1 

21.5 

38.1 

28.3 

E  31.1 

7.9 

E  32.1 

14.7 

30.0 


TABLE 


PERCENTAGE  CONTRIBUTION 
SUBASSEMBLY  TO  SYSTEM 


X  UNAVAILABILITY 


UNRELIABILITY 


%  Assy 

State-Sys 

A 

Assy  ID 

B 

%  Assy 
State 

C 

15.3 

208.6 

10.5 

12.8 

204.7 

21.8 

12.8 

200.7 

24.8 

6 . 5 

39.6 

17.7 

6.5 

38.6 

22.4 

38.6 

22.4 

RUN  EIGHT 
UNDEPENDABILITY 


Sys  ID  iNumber  of  I  Subassy  |%Subassyl  $Subass 


Subassy  ID 
E  Ef 


2 


200.7 


39.6 


38.6 


E  35. 2 


E  35.3 


8.8  12.8 


21.7  12.8 


12.7 


17-7 


17-7 


.12.7 

208.4 

13.0 

11.8 

204.5 

19.5 

11.8 

200.5 

22.1 

8.1 

39.5 

21.1 

8.1 

38.5 

26.7 

8.1 

38.5 

26.7 

204.5 

12.1 

200.5 

19.5 

39.5 

15.2 

38.5 

21.1 

E  35.1 

14.1 

E  81 .1 

12.6 

11.8 


11.8 


8.1 


8.1 


31.0 

208.1 

25.4 

29.2 

204.1 

^7-3 

21.8 

200.1 

4o.l 

18.2 

39.1 

46.6 

18.2 

39.1 

46.6 

10.3 

38.1 

330 

10.3 

38.1 

33.3 

10.3 

38.1 

33-3 

204.1 

23.9 

29.2 

200.1 

35.3 

21.8 

39.1 

33 -5 

18.2 

40.1 

20.1 

7.8 

38.1 

26.3 

10.3 

E  32.1 

13.5 

E  33.1 

12.5 

TABLE  11  PERCENTAGE  CONTRIBUTION  TO  ASSEMBLY  TASA  Nr.  2 
UNAVAILABILITY  BY  ELEMENTS  TASA  Nr.  35  AND  81. 


TASA  Nr. 

210 

RUN 

ONE 

3.4 

RUN 

FIVE 

2.0 

RUN 

SEVEN 

1.4 

RUN 

EIGHT 

4.3 

TASA  Nr. 

2.4 

210 

21a 

13-9 

2.1 

8.1 

1.3 

5.7 

0.8 

5.1 

1.4 

2.8 

2.6 

81  ^ 

TOTAL 

9.2 

28.6 

5-5 

16.9 

5.6 

13-5 

3.8 

14.6 

2.4 

35  &  81 

SECTION  IV 


TRADE-OFF  ANALYSIS  IN  THE  SUBSYSTEM  DESIGN  PHASE 


INTRODUCTION 


A  basic  selection  criterion  for  trade-offs  during  the  design  phase 


of  an  avionic  system  is  the  dollar  cost.  The  costs  associated  with 


each  equipment  design  alternative  are  computed,  and  the  least  costly 


alternative  that  provides  the  desired  system  effectiveness  is  selected 


The  costs  associated  with  alternative  designs  are  composed  of  such  cost 


categories  as  design,  development,  acquisition  and  operation.  The 


general  costs  contributing  to  the  categories  discussed  in  this  report 


are  shown  in  Figure  l6.  -More  specifically,  the  equipment  design  and 


development  costs  and  maintenance  or  repair  costs  presented  in  this 


study  are  hypothetical 


Making  an  equipment  more  reliable  will  usually  increase  its  ini' 


tial  cost.  This  increase  can,  however,  be  more  than  offset  by  econo' 


mica  in  maintenance  and  repair  costs.  When  an  equipment  fails,  there 


is  a  loss  of  service  which  results  in  system  unavailability,  and 


directly  affects  the  mission.  Also,  it  may  be  necessary  to  provide 


one  or  more  costly  avionic  systems  as  standby.  Thus,  the  lower  the  re 


liability  or  maintainability,  the  more  unavailable  the  system  will 


become  and  the  higher  the  number  of  extra  systems  which  must  be  provided 


Besides  the  increased  equipment  unavailability,  there  i 


cost  of  repair  and  maintenance 


As  discussed  by  Blanchard  and  Lowry  in  their  text  entitled 


RELIABILITY 


MAINTAINABILITY 


Cost  of  Failure  Reporting 

Related  Cost  of  Design  and 
Development 

Manufacturing  Costs 

Quality  Assurance  Testing 


Maintenance  and  Repair  Cost 
Spares  Cost 

Related  Cost  of  Design  and 
Development 

Standby  Equipment 
Total  Repair  Manhours 
Technician  Training 
Cost  of  Testing 


Figure  l6.  Ceneral  Cost  Categories  relating  to  the 

Equipment  Reliability  and  Maintainability 
Design 


"Maintainability",  trade-off  techniques  must  not  depend  on  an  in¬ 
tuitive  process  when  considering  increasingly  complex  systems  and  re¬ 
sulting  high  cost  in  making  a  realistic  decision  fU],  One  trade-off 
application,  for  example,  is  that  of  cost  of  design  for  system  relia¬ 
bility  improvement  versus  cost  of  design  for  system  maintainability 
improvement,  in  order  to  achieve  a  specified  system  availability  at 
a  minimum  total  life  cost. 

Trade-off  analysis  at  the  system  level  should  be  initiated  in 
the  conceptual  phase  of  a  program  to  assess  minimum  investment  before 
design  finalization  and  resulting  costly  retrofit  later.  Trade-offs 
at  subsystem  levels  are  normally  conducted  during  the  definition 
phase,  while  trade-offs  at  the  detail  level  will,  in  all  probability, 
be  accomplished  in  the  advanced  development  and  acquisition  phase 
of  the  system. 

MINIMIZING  TOTAL  SYSTEM  COST 

The  initial  step  in  any  optimization  procedure  should  be  an 
examination  of  the  various  alternatives  for  possible  trade-off  between 
the  Research  and  Development  (R&D)  investment  and  the  annual  operation 
and  maintenance  cost.  As  discussed  by  Seiler  in  his  text  entitled 
"System  Cost  Effectiveness",  the  total  system  cost  may  be  reduced 
without  changing  system  effectiveness,  by  adjusting  the  balance  be¬ 
tween  the  RfcD  investment  and  operation  costs  wherein  the  total  cost, 

TC  =  ‘♦1+0,  is  a  minimum  [2 7].  Period  costing  is  the  most  commonly 
used  method  of  comparing  the  cost  of  alternative  systems  over  a  set  in¬ 
terval  of  time..  It  represents  the  summary  of  all  system  costs  for  a 
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fixed  period  of  time,  including  annual  maintenance  and  operating  cost, 
plus  the  annual  equivalent  cost  of  R&D  investment  at  an  interest  rate 
of  9 !  for  a  total  system  life  use  of  ten  years. 

Cost  estimates  for  the  Ka-Band  SATCOM  Set  under  this  study  and 
for  the  assemblies  making  up  this  set  were  generated  by  Battelle, 
using  the  PRICE  MODEL  approach  described  in  Section  II,  in  Appendix  B 

of  this  report  and  in  Technical  Report  AFAL-TR-78-135  [ ] .  The  sub¬ 
systems  units  most  likely  to  fail  were  identified.  Particular  atten¬ 
tion  was  given  to  these  units  to  determine  the  effect  of  cost  increase 
based  on  changes  in  their  MTBF's.  Finally,  one  subassembly,  the  High 
Voltage  Power  Supply,  was  selected  for  trade-off  techniques  demonstra¬ 
tion.  Figure  13  in  Section  II  illustrates  the  relationship  of  increas¬ 
ing  cost  to  MTBF  improvement,  suggesting  that  the  cost  to  MTBF  ratio 
for  the  item  under  consideration  should  be  viewed  as  a  square  function. 
However,  an  improvement  in  assembly  maintainability,  which  is  a  re¬ 
duction  in  restoration  time  by  a  factor  of  2,  would  result  in  an  in¬ 
crease  in  acquisition  cost  of  7%,  as  discussed  in  AFSC  Design  Hand¬ 
book  1-9  t32].  This  would  suggest  that  the  same  increase  in  the  equip¬ 
ment  availability  would  result  in  a  substantial  cost  increase  when 
reliability  improvement  is  addressed,  but  a  small  increase  when  main¬ 
tainability  improvement  is  considered.  This  would  demonstrate  that 
for  similar  increases  in  system  availability,  the  maintainability 
equipment  cost  would  be  less. 

A  minimum  cost  decision  model  was  used  in  computing  the  results 
reported  in  Tables  12,  13,  lU,  15,  and  16.  The  model  is  described  in 
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TABLE  13  RELIABILITY  IMPROVEMENT  FOR  ELEMENT  35 

n  =  2.0  (Alternative  A) 
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AVAILABILITY  0.9970  0.9970 


Appendix  E,  with  calculation  procedures  and  tase  line  assumptions  as 
presented.  The  MTBF  was  varied  from  the  "base  line  RUN  ONE  with  MTBF 
to  MTBF  (BASE)  ratio  as  1.0  to  RUN  FIVE  when  the  ratio  is  2.0.  The 
corresponding  availabilities  value  were  computed  using  the  TASA/DEPEND 
program  as  described  in  Section  II  and  Appendices  A,  B  and  C.  Also, 
the  exponent  n  of  the  MTBF  ratio  (X)  was  varied,  as  shown  in  Tables  13, 
lit,  and  15. 

In  RUN  EIGHT  the  MTBF  ratio  was  set  to  1  and  the  exponent  n  of 
the  MTBF  ratio  was  set  to  2.  The  MTTR  values  for  Elements  38  and  8l 
were  set  to  one  hour.  The  results  are  in  Table  16  in  terms  of  avail¬ 
ability  as  given  in  Appendix  C.  The  results  of  Tables  13  and  l6  are 
presented  in  Figures  IT  and  18. 

RELIABILITY  IMPROVEMENT  COST  ESTIMATES 

Table  12  lists  the  data  stored  in  the  data  register  of  the  Pro¬ 
grammable  Calculator  TI-58  with  the  output  as  printed  on  the  PC-100A 
printer  [ 31 ] .  The  program  coding  and  user  instruction  are  given  in 
Appendix  E.  The  computation  procedures  are  also  given  with  definition 
for  the  various  parameters  such  as  N,  I,  Mr,  etc.  A  base  line,  RUN  ONE, 
was  established  with  a  MTBF  ratio  of  Mr=l,  and  exponent  n  of  2.  Repair 
cost  for  one  failure  of  11K  dollars,  equipment  acquisition  cost  of 
$1*06K,  MTBF  of  328  hours,  N  of  10  year  operation  period,  and  I  rate 
per  year  of  9 %  were  assumed.  The  MTBF  ratio  (Mr)  for  minimum  cost 
was  calculated  as  1.127.  This  was  based  on  the  assumptions  discussed 
in  Appendix  E,  resulting  in  a  total  annual  equivalent  cost  (TC)  of 
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$2*41,0*42.  Table  13  shows  again  the  minimum  cost  at  $2*41,0*42  and  in¬ 
creasing  cost  at  RUN  ONE,  (Mr=l) ,  and  RUNS  TWO,  THREE,  FOUR,  and  FIVE. 
Also,  as  the  MTBF  is  increased  from  328  hours  to  656  hours,  availability 

increases  to  0.9965  with  approximately  a  50#  increase  in  total  cost 
from  minimum  total  cost. 

In  Table  1**,  11  was  set  at  1.5  and  in  Table  15,  n  equals  1.0  as 
a  straight  line  cost  model.  At  n  =  1.5,  the  minimum  total  cost  is 
$233,073  with  a  MTBF  ratio  of  1.295  or  1.3  which  is  nearly  the  same 
as  RUN  THREE  with  an  availability  of  0.9953.  At  n  =  1.0,  the  minimum 
total  cost  is  $21*4  ,073  with  a  MTBF  ratio  of  1.692  or  1.7,  which  is 
nearly  the  same  as  RUN  FOUR  with  an  availability  of  0.9959.  However, 
based  on  the  findings  of  Battelle  using  the  RCA-PRICE  cost  model,  as 
reported  in  reference  1*4,  an  exponent  n  of  2  will  provide  a  reduc¬ 
tion  in  cost  estimate  for  the  Element  35  under  study.  Another  al¬ 
ternative  under  consideration  was  a  reduction  in  restoration  time 
( MTTR )  as  an  improvement  in  maintainability,  RUN  EIGHT,  as  shown  in 
Table  16. 

MAINTAINABILITY  IMPROVEMENT  COST  ESTIMATE 

In  RUN  EIGHT,  the  MTBF  was  set  to  the  base  line  of  328  hours  and 
the  MTTR  changed  to  one  hour.  This  resulted  in  an  availability  cal¬ 
culation  of  0.9970  using  the  TASA/DEPEND  MODEL.  Since  the  MTTR 
was  reduced  by  half,  the  acquisition  cost  of  $*406,000  for  the  item 
under  study  was  increased  to  $*4  3*4  , *420.  This  is  based  on  the  down¬ 
time  cost  relationship  as  discussed  in  AFSC  Design  Handbook  1-9 
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for  maintainability  [32].  Since  data  consisting  of  observed  equipment 
down  time  and  Research  and  Development  initial  investment  cost  factors 
affecting  maintainability  are  not  readily  available,  a  very  simple 
logarithmic  formula,  given  below,  can  be  used  to  represent  the  ini¬ 
tial  elements  of  the  equipment  maintainability  design  and  develop¬ 
ment  cost.  Maintainability  acquisition  cost  (COM)  =  0.1  CD  Ln  Im, 

CD  is  the  state-of-the-art  acquisition  cost.  Im  is  the  maintain¬ 
ability  improvement  ratio  of  the  state-of-the-art  downtime  per 
failure  to  planned  time..  Thus,  the  equation  shows  that  halving  the 
active  repair  time,  Im  =  2,  adds  7%  to  the  acquisition  cost. 

SELECT  OPTIMUM  COST  TO  PERFORMANCE  DESIGN  WITH  CONCLUSIONS 

The  cost  to  performance  trade-offs  for  the  equipments  under 
study  were  addressed  in  terms  of  variation  in  cost  to  MTBF  and  cost 
to  MTTR.  See  Figure  IT-  An  Alternative  A  was  based  on  minimum  cost 
as  the  MTBF  was  varied  with  MTTR  fixed,  while  Alternative  B  was  based 
on  changes  in  MTTR  with  a  fixed  MTBF  for  Elements  35  and  8l.  Both 
of  the  alternatives  are  presented  in  Figure  l8  in  terms  of  availability 
and  its  values  of  MTBF  or  MTTR.  The  ratio  presented  in  Figures  17 
and  18  demonstrates  that  the  total  cost  of  an  equipment  can  be  mini¬ 
mized.  However,  the  minimum  cost  must  be  weighed  against  mission  re¬ 
quirements.  Therefore,  Alternative  B  would  be  the  better  choice 
because  the  availability  was  increased  appreciably  at  a  modest  in¬ 


crease  in  total  costs. 


SECTION  V 


CONCLUSIONS  AND  RECOMMENDATIONS 

A  practical  approach  (TASA/DEPEND  Program)  for  analyzing  sys¬ 
tem  "ilities"  has  been  demonstrated.  This  approach  provides  an  anal¬ 
ysis  tool  for  studying  the  impact  of  changes  in  mission  use  profile 
on  reliability,  availability  and  dependability  so  that  mission  plans 
can  be  enhanced  with  respect  to  achieving  design  objectives  as  re¬ 
lated  to  cost.  An  important  feature  of  this  analysis  approach  is  that 
the  impact  of  malfunctions  and  failures  are  separately  assessed.  This 
makes  it  possible  to  directly  relate  the  contributions  to  hardware 
module  reliability  and  maintainability  to  functional  block  performance. 
Such  studies  provide  a  means  for  concentrating  reliability  and  main¬ 
tainability  resources  in  areas  that  will  provide  the  maximum  system 
improvement.  Also,  a  rational  basis  for  trade-offs  between  reliability 
and  maintainability  requirements  is  obtained  in  relationship  to  cost. 
Thus,  the  DEPEND  Program  can  be  a  valuable  tool  for  management  of 
reliability /maintainability  programs,  development  of  requirements  for 
procurement  specifications,  evaluations  of  the  "ility"  impact  of  en¬ 
gineering  changes  and  the  assessment  of  testing  programs. 


APPENDIX  A 


TASA/DEPEND  PROGRAM 

INTRODUCTION  AND  SUMMARY 

This  appendix  discusses  the  use  of  the  DEPEND  computer  program  to  obtain 
values  for  dependability,  availability,  reliability  and  related  performance 
parameters  for  all  the  assemblies  of  a  system's  functional  hierarchy.  The 
model  used  with  this  program  provides  for  the  use  of  alternative  malfunc¬ 
tion  and  failure  definitions  and  calculates  the  corresponding  probabilities  of 
assembly  malfunction  or  failure;  that  is,  the  undependabilities,  unavailabili¬ 
ties  and  unreliabilities.  The  DEPEND  program  keeps  track  of  all  the  organi¬ 
zational  details  of  the  model  and  performs  the  arithmetic  as  well.  The  mathe¬ 
matical  basis  of  this  technique  are  described  in  Appendices  B  and  C  of  this 
report . 

The  mathematical  models,  details  of  the  analysis  methods  and  the  results 
obtained  in  an  analysis  of  an  airborne  EHF  communications  terminal  were  pre¬ 
sented  in  final  project  report  (Reference  lU).  Part  III  of  this  report 
is  a  User's  Manual,  containing  instructions  for  use  of  the  TASA/DEPEND  method¬ 
ology.  The  complete  analysis  procedure  consists  of  the  three  processes,  (l) 
Tabular  System  Analysis  (TASA),  (2)  acquisition  of  the  required  functional  ele¬ 
ment  data  (MTBF  or  MTTR )  and  (3)  computation  using  the  DEPEND  computer  program. 
TABULAR  SYSTEM  ANALYSIS  (TASA) 

The  basic  TASA  concept  as  developed  by  Mr.  Jim  Drennan  of  Battelle,  is 
described  as  a  nested  organization  of  interdependent  and  interacting  devices 
operating  to  accomplish  a  specified  function  [8]..  To  assess  over  all  sys¬ 
tem  dependability,  availability,  or  reliability,  it  is  necessary  to  consider 
these  qualities  in  the  individual  components  and  subsystems  which  are  the 


constituent  elements.  Such  an  assessment  requires  consideration  of  the 
consequences  of  malfunctions  or  failures  occurring  in  the  various  subsystems, 
both  singly  and  in  combination,  in  terms  of  functional  states  of  components 
and  other  assemblies  that  can  be  defined  in  an  overall  description  of  the 
system. 

The  first  step  in  an  application  of  TASA  is  to  develop  a  chart  or  charts 
showing  the  functional  relationship  of  the  elements,  assemblies  and  subsystems 
that  make  up  the  system.  The  partitioning  of  the  system  into  functional  as¬ 
semblies  is  not  critical  with  respect  to  the  DEPEND  program.  However,  it  is 
recommended  that  the  partitioning  be  done  in  a  way  that  simplifies  the  deter¬ 
mination  of  the  consequences  of  malfunctions  or  failures;  that  it  simplifies 
the  functional  complexity. 

An  example  of  a  functional  hierarchy  that  describes  the  upper  levels 
of  the  airborne  Ka-Band  SATCOM  Terminal  is  given  in  Section  II,  Figure  6. 

The  numbers  in  the  lower  left  hand  corners  of  functional  blocks  are  assigned 
for  use  as  identifiers  throughout  the  analysis.  The  Ka-Band  Terminal  has 
three  primary  functional  links,  the  forward  link,  the  report-back  link  and 
the  conference  link  as  discussed  in  Section  II.  Part  of  the  system  elements 
are  functionally  common  to  two  or  more  links.  Functionally  common  means 
that  a  malfunction  or  failure  will  cause  more  than  one  link  to  be  degraded 
or  inoperative.  It  is  also  necessary  to  consider  the  system  initialization 
(start-up)  function  and  the  primary  power  source. 

It  is  important  to  recognize  that  function  is  distributed  across  time 
as  well  as  across  hardware  components.  This  is  illustrated  in  Figure  6 
of  Section  II  by  noting  that  the  three  links  of  the  Ka-Band  Terminal  operate 


for  different  lengths  of  time  during  a  mission.  To  simplify  the  logic 
as  well  as  facilitate  computations,  functional  blocks  have  been  added 


to  express  the  transition  from  one  functional  cycle  of  use  of  a  specific 
assembly  to  the  transmission  or  reception  of  one  message  and  ultimately 
the  total  nuiuDers  of  messages  transmitted  and  received  during  the 
mission. 

During  the  development  of  the  functional  hierarchy  for  the  system, 
mutually  exclusive  functional  states  are  defined  for  each  assembly 
and  subassembly  in  the  system  hierarchy.  Thus,  the  functional  state 
of  the  system  is  represented  as  depending  upon  the  functional  states  of 
the  next  lower  level  assemblies  and  so  on  down  to  the  lowest  level  sub- 
assemblies  (elements)  for  which  meaningful  functional  states  can  be 
defined.  The  resulting  arrangement  of  assemblies  and  their  functional 
states  may  be  thought  of  as  a  state  tree.  The  state  tree  (See  Appen¬ 
dix  C)  is  similar  to  the  fault  tree  of  Fault-Tree  Analysis  and,  indeed, 
that  is  its  origin.  However,  the  state  tree  is  not  limited  to  faults 
and  can  include  almost  anything  pertinent  to  the  system's  function  [5]. 
Furthermore,  because  TASA  considers  all  possible  combinations  of  states, 
the  TASA  state  tree  corresponds  to  all  of  the  possible  Fault  Trees  for 
the  system  together  with  the  trees  associated  with  other  states  that 
are  not  actually  faults.  The  approach  is  demonstrated  using  TASA 
Nr.  10  it  in  Appendix  C,  Figure  C-l. 

The  third  part  of  the  TASA  is  the  engineering  determination  of  the 
functional  state  of  each  system  assembly  based  on  various  combinations 
of  the  functional  states  of  the  constituent  assemblies.  Tabular  work 
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sheets  are  provided  for  TASA  use  that  list  in  a  systematic  manner  se¬ 
lected  combinations  of  input  assembly  functional  states.  With  these 
tables,  up  to  697  separate  engineering  decisions  can  be  made  and  doc¬ 
umented  in  the  analysis  of  each  assembly  [lh]  (Tahle  C-2). 

The  basic  concept  underlying  this  part  of  TASA,  as  discussed  in 
Appendic  C,  is  to  assume  a  particular  combination  of  the  functional 
states  for  all  of  the  subassemblies  that  make  up  a  given  assembly  and 
then  make  an  engineering  estimate  of  functional  consequences  in  terms 
of  the  assembly  functional  state  that  would  result.  This  process  is 
repeated  for  all  combinations  of  subassembly  functional  states  under 
the  practical  constraints  that  no  more  than  3  subassembly  functional 
states  will  be  varied  simultaneously. 

DEPEND  PROGRAM  FUNCTIONAL  ELEMENT  DATA  ACQUISITION 

MTBF  and  MTTR  data  are  required  for  each  malfunction  and  failure 
state  defined  for  each  functional  element  of  the  system.  In  the  early 
stages  of  system  development,  when  the  emphasis  is  placed  on  "ility" 
prediction,  the  procedures  of  MIL-HDBK-217B  and  AFSC  DH  1-9  can  be  used 
to  predict  the  MTBF  and  MTTR  for  each  element  malfunction  and  failure 
state  [23]  [22].  The  resulting  DEPEND  outputs  are  the  "ility"  predic¬ 

tions  for  the  system.  Where  actual  experience  data  are  available  for 
the  functional  elements,  these  data  can  be  used.  In  this  case  the 
DEPEND  outputs  are  an  "ility"  assessment  of  the  system.  Bayesian 
combinations  of  predicted,  experience  and  test  data  can  also  be  used 
to  generate  a  practical  set  of  element  MTBF  and  MTTR  values.  One  pro¬ 
cedure  for  making  such  combinations  is  described  in  Part  1  of  technical 
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report  AFAL-TR-78-135  [lM*  In  any  case,  the  credibility  and  inter¬ 
pretation  of  the  analysis  results  will  depend  on  the  validity  and  choice 
of  the  element  data  used.  Thus,  it  is  necessary  to  document  and  sub¬ 
stantiate  the  source  of  element  MTBF  and  MTTR  values  used  as  input  for 
the  DEPEND  program. 

USING  THE  DEPEND  PROGRAM 

The  DEPEND  program  runs  in  batch  mode  from  a  punched  card  deck 
that  consists  of  a  control  record,  relocatable  binary  program,  and  four 
data  records,  as  discussed  in  the  User's  Manual  by  Drennan  [lU],  Op¬ 
eration  of  the  DEPEND  program  requires  the  user  to  supply  four  types 
of  data:  (l)  output  control  data;  (2)  assembly  identifications  and 
functional  state  definitions;  (3)  element  MTBF  and  MTTR  values;  and 
(h)  functional  operation  data,  structure  data  and  fault  consequence 
data. 

Job  Control  and  Data  Records .  The  operation  of  the  DEPEND  computer 
code  to  perform  the  TASA  calculation  requires  a  job  control  record 
which  utilizes  a  relocatable  binary  program  deck. 

Output  Control  and  Title  (Table  A-l).  The  first  data  record  consists 
of  an  output  control  card,  followed  by  up  to  five  title  cards.  The 
first  card  of  this  record  (output  control  card)  contains  four  logical 
values  and  the  ATTR  Weighting  Factor,  all  separated  by  commas.  A  .TRUE, 
value  of  the  first  logical  variable  will  cause  a  listing  of  the  state 
identifications  to  be  printed.  If  the  second  logical  variable  is  .TRUE., 
a  listing  of  the  element  MTBF  and  MTTR  values  and  a  listing  of  the 
corresponding  reliability/unreliability  and  availability/unavailability 
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values  are  printed.  Setting  the  third  logical  variable  to  .TRUE, 
causes  the  analysis  tables  to  be  recorded  and  if  the  fourth  logical 

variable  is  .TRUE.,  the  percentage  contribution  tables  will  be  re¬ 
corded. 

The  ATTR  Weighting  Factor  is  used  by  the  program  whenever  the  cal¬ 
culations  involve  states  incuding  more  than  one  malfunction.  In  such 
cases,  the  largest  of  the  pertinent  restore  times  is  extended  by  a  por¬ 
tion  of  the  sum  of  the  other  pertinent  restore  times.  If  the  value  of 
the  Weighting  Factor  is  zero,  only  the  longest  of  che  pertinent  restore 
times  is  used.  A  Weighting  Factor  value  of  1.0  will  cause  the  sum 
of  the  pertinent  restore  times  to  be  employed  in  the  calculations.  In¬ 
termediate  values  of  the  Weighting  Factor  will  cause  a  corresponding 
portion  of  the  summed  restore  times  to  be  used.  The  first  card  of 
Table  A-l  illustrates  the  control  card  format  for  the  case  where  some 
of  the  outputs  are  required  and  the  value  of  the  ATTR  Weighting  Factor 
is  0.8. 

Assembly  Identification  and  Functional  State  Definition  (Table  A-l). 

The  second  data  record  consists  of  identification  of  all  the  el¬ 
ements,  subassemblies  and  assemblies  in  the  system  and  definitions  of 
their  functional  states.  The  cards  may  be  in  any  order,  but  it  is 
recommended  that  the  numeric  sequence  be  retained  within  cards  for  a 
given  functional  block.  The  first  three  columns  of  each  card  are  the 
identification  numbers  assigned  for  the  element,  subassembly  or  assem¬ 
bly;  the  fourth  column  is  a  decimal  point;  and  the  fifth  column  is  the 
state  number  in  the  range  from  0  to  8.  State  number  0  is  used  to 
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denote  the  element,  subassembly  and  assembly  identifications.  The 
alphanumeric  identification  corresponding  to  the  numeric  identification 
appeal i  in  columns  11  through  80. 

Element  Data  (Table  A-2).  Data  Record  THREE  contains  the  input  data 
for  the  analysis  elements  in  the  form  of  MTBF  and  MTTR  values  for  each 
malfunction  and  failure  state.  If  the  number  of  element  states  (column  5) 
is  greater  than  4,  the  MTBF  and  MTTR  values  are  continued  on  a  second 
card  starting  in  column  16.  The  element  number  must  be  repeated  on  this 
card  in  columns  1-3  and  J6-J8  and  the  sequence  number  12  is  punched  in 
columns  79-80.  Example:--  TASA  Nr.  108. 

System  Functional  Model  (Table  A-3) .  Data  Record  Four  must  contain  an 
entry  for  each  nonelement.al  assembly  in  the  system.  Each  such  entry 
will  consist  of  two  or  more  cards.  The  first  card  describes  the  char¬ 
acteristics  of  the  assembly.  The  model  data  for  the  assembly  is  entered, 
starting  with  the  second  card.  This  data  consists  of  the  consequence 
assignments  from  the  TASA  Work  Sheets.  There  may  be  up  to  697  such 
assignments,  depending  upon  the  number  of  input  malfunction  or  failure 
states.  These  data  are  entered  with  25  values  per  card  (26  for  the 
first  card). 

TASA/DEPEND  ANALYSIS  DEMONSTRATION 

In  the  following  pages,  example  computer  printouts  are  given,  pre¬ 
senting  results  of  the  analysis  for  the  Ka-Band  SATCOM  Set.  These  anal¬ 
yses  are  based  on  data  obtained  from  the  results  presented  in  AFAL-TR- 
78-135  and  AFAL-TR-78-U5  (lM,  [3]. 

Element  Data  Listings.  Several  types  of  outputs  relating  to  the  element 
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data  are  printed  by  the  computer.  These  are:  input  card  images 


numerical  list  of  elements  processed,  and  optional  listings  of  pro¬ 
cessed  element  data.  To  provide  a  record  of  the  element  data  used  in 
the  DEPEND  run  and  to  aid  in  the  correction  of  errors  or  changing  of 
input  data,  a  card  image  listing  of  the  element  data  record  is  print¬ 
ed.  An  example  of  this  output  is  shown  in  Table  A-2  and  A-b.  Also, 
in  Table  A-it,  MTBF  and  MTTR  values  for  various  RUNS  are  given.  By  set¬ 
ting  the  second  field  of  the  output  control  card  to  .TRUE..,  two  listings 
are  ordered  by  increasing  the  numeric  label  and  including  the  element 
identifications  and  the  functional  state  definitions.  Also  included 
are  the  data  for  the  number  of  functional  cycles  and  use  time  per  func¬ 
tional  cycle.  The  first  listing  documents  the  MTBF  and  MTTR  values. 

An  example  of  this  listing  is  shown  in  Table  A-5-  The  second  listing 
shows  the  calculated  values  of  reliability  and  availability  based  on 
these  data.  An  example  of  this  output  is  shown  in  Table  A-6. 

Input  Data  Tabulation.  The  input  data  tabulation  (Table  A-5)  lists 
the  ELEMENT  LABEL,  which  is  an  identification  number  for  each  element 
followed  by  a  listing  of  the  DATA  IDENTIFICATION,  which  describes 
each  data  element.  The  elements  include  functional  blocks  of  the  sys¬ 
tem  and  the  various  possible  states  of  malfunction  or  failure  of 
these  blocks,  as  used  in  the  analysis.  The  functional  blocks  can 
be  readily  identified,  because  the  element  label  number  associated 
with  them  has  a  zero  following  the  decimal  point.  Thus,  element 
label  035.0  is  the  Ka-Band  transmission  subgroup.  The  various 
malfunction  states  for  the  Ka-Band  transmission  are  then  listed  under 
element  label  035.0,  but  with  various  numbers  following  the  decimal 
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TABLE  A-4  ELEMENT  DATA  INPUT  FOR  VARIOUS  RUNS 
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point.  Element  label  number  35.1,  for  example,  and  its  associated 
data  identification,  "Degraded  RF  Power  Output  (50  watt  max.)"  pro¬ 
vided  the  information  that  the  transmission  subgroup  was  in  a  degraded 
state  at  the  elemental  level. 

The  column  headed  CYCLES  contains  a  1  or  a  0,  indicating  that 
the  functional  block  listed  is  or  is  not  used  during  the  mission 
for  which  the  specific  analysis  is  being  performed. 

The  column  headed  USE, SEC  lists  the  number  of  seconds  required 
to  complete  one  functional  cycle  of  the  subject  functional  block. 

Thus  element  L.0,  the  SATCOM  Terminal  (Primary  Power),  for  example, 
is  used  for  36,000  seconds;  that  is,  for  the  entire  ten  hours  of  the 
mission  described  in  the  main  body  of  this  report.  The  functional 
cycle  duration  for  most  functional  blocks  is  h.2  seconds,  although 
there  are  several  exceptions. 

The  column  labelled  MTBF,  HRS,  lists  the  MTBF  associated  with 
that  assembly  or  malfunction,  in  hours  (It  should  be  remembered 
that  these  figures  constitute  an  input  to  the  computer  program).  This 
column,  and  the  last  column  (MTTR,HRS),  at  the  basic  building  block 
level,  contain  data  generated  during  flight  test,  received  from  man¬ 
ufacturers,  etc..  The  results  obtained  for  the  higher  functional 
levels  are  based  on  the  data  for  the  basic  building  block  level. 
ANALYSIS  SCHEDULE 

The  actual  operation  of  the  DEPEND  program  is  to  perform  the  com¬ 
putations  for  each  functional  assembly  separately  once  all  the  nec¬ 
essary  input  data  are  available.  Prior  to  the  start  of  any  compu¬ 
tations,  a  scheduling  routine  is  used  to  determine  the  order  in 
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which  the  computations  will  be  performed.  This  routine  prints  the 
resultant  analysis  schedule,  showing  the  elements/subassemblies  used 
by  each  assembly  and  the  next  assemblies  to  use  the  results  obtained. 
Since  the  order  of  the  printed  results  are  in  the  order  in  which  com¬ 
putations  are  performed,  this  Analysis  Schedule  is  an  index  to  the 
results  and  to  the  State  Assignment  Listing  described  above.  An  ex¬ 
ample  Analysis  Schedule  is  shown  in  Table  A-7. 

ANALYSIS  SUMMARY 

The  results  of  the  DEPEND  calculations  are  output  in  both  tab¬ 
ular  and  statement  form.  A  title  page  is  provided  to  document  the 
date  and  time  of  the  DEPEND  run  and  the  title  of  the  analysis.  An  ex¬ 
ample  title  page  is  shown  in  Figure  A-l. 

Tabular  Summary  of  Results.  The  results  of  the  "ility"  computations 
for  each  functional  assembly  are  printed  in  an  Analysis  Summary  on  one 
page  of  the  computer  output.  An  example  Analysis  Summary  is  shown  in 
Table  A-8.  At  the  top  of  the  summary,  the  assembly  is  identified  to¬ 
gether  with  the  other  assemblies  which  use  it,  if  any. 

Next  are  listed  the  subassembly  or  element  state  data  employed 
in  terms  of  the  probability  of  state  occurrence  during  use  (unrelia¬ 
bility)  and  unavailability.  The  entry,  ENT,  following  the  label  de¬ 
notes  an  element,  while  CMP  denotes  a  subassembly.  The  number  of 
functional  cycles,  the  time  used  per  cycle  and  the  average  restore 
time  are  also  listed.  Note  that  the  unreliabilities  and  unavailabil¬ 
ities  for  the  assembly  functional  states  are  only  printed  in  the 
Analysis  Summary  for  the  next  level  assembly  where  it  is  used.  In 
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the  case  where  the  assembly  is  a  top  level  one,  a  separate  listing  is 
printed  on  the  next  page  to  record  the  "ility"  data  and  the  undepend¬ 
ability,  unreliability  and  unavailability  for  each  non-normal  state. 

An  example  of  such  a  System  Data  listing  is  shown  in  Table  A-9. 

Referring  again  to  Table  A-8,  the  second  part  of  the  Analysis 
Summary  records  the  probabilities  of  occurrence  of  each  functional 
state  defined  for  the  assembly.  The  probability  of  normal  operation 
is  the  dependability,  while  the  probabilities  of  occurrence  of  the 
other  functional  states  are  the  corresponding  undependabilities.  An 
extra  "residual"  state  is  included  to  account  for  the  occurrence  of 
states  not  explicitly  defined,  including  those  cases  of  four  or  more 
simultaneous  state  occurrences.  Included  in  this  part  of  the  summary 
are  calculated  predictions  of  the  average  time  between  occurrences  of 
the  non-normal  states  and  the  average  time  to  restore  normal  operation 
after  such  an  occurrence. 

The  combined  prediction  for  ATBO  expresses  the  average  time  be¬ 
tween  occurrences  of  any  of  the  non-normal  states.  The  combined  ATTR 
is  the  average  restore  time,  taking  into  account  the  probability  of 
occurrence  of  each  non-normal  state. 

Statement  of  Results  At  the  bottom  of  each  Analysis  Summary  is  printed 
a  statement  summarizing  the  operation,  "ility"  results,  expected  num¬ 
ber  of  occurrences  of  non-normal  states,  and  the  delay  that  the  system 
user  is  expected  to  experience  in  case  of  a  malfunction. 

Functional  Model  Data  Listings 

The  DEPEND  Program  output  includes  two  types  of  listings  to  doc¬ 
ument  the  functional  model  data.  These  are  a  listing  of  input  card 
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images  and  an  optional  listing  that  reproduces  the  TASA  work  sheet 
format  to  show  the  details  of  the  state  combinations  and  consequence 
assignments.  The  listing  of  input  card  images  from  the  model  input 
deck  documents  the  data  used  for  the  DEPEND  run.  It  is  a  primary 
means  of  tracking  down  errors  and  debugging  the  model  data.  An  ex¬ 
ample  of  this  listing  is  shown  in  an  earlier  section.  The  system 
functional  model  (Table  A-3)  is  actually  documented  in  the  TASA  work 
sheets.  Setting  the  third  field  of  the  output  control  card  to  .TRUE, 
causes  the  computer  to  reproduce  the  TASA  data  in  tabular  form.  It 
provides  a  printed  record  of  the  TASA,  including  the  identification  of 
the  elements,  subassemblies  and  assemblies  and  the  consequences  deter¬ 
mined  for  each  combination  of  element/subassembly  states  for  each 
assembly.  As  a  general  rule,  once  the  model  has  been  debugged  and  a 
finalized  copy  of  this  listing  obtained,  the  listing  will  not  be  printed 
for  runs  made  with  updated  element  data.  However,  this  listing  does 
provide  comprehensive  documentation  of  the  model  structure  and 
consequence  assignments  used  for  the  DEPEND  run.  An  example  page  O'0 
this  State  Assignment  Listing  is  shown  in  Figure  C-5  of  Appendix  C. 

The  total  listing  for  a  system  of  any  size  is  quite  large.  A  title 

page  is  provided  for  the  listing,  so  that  it  is  an  independent  doc¬ 
umentation  of  the  model. 

OPTIONAL  SENSITIVITY  TABULATIONS 

When  the  fourth  field  of  the  output  control  card  is  set  to  .TRUE, 
in  Table  A-l,  the  DEPEND  program  will  output  the  results  of  sensitiv¬ 


ity  calculations  for  each  assembly. 
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Percentage  Contribution  Tabulations.  The  results  of  the  sensitivity- 
calculations  are  presented  in  terms  of  the  percentage  contribution  of 
each  element  or  subassembly  state  to  the  unavailability,  unreliabil¬ 
ity  and  undependability  for  each  defined  assembly  state.  An  example 
page  of  the  output  is  shown  in  Table  A-10.  From  this  tabulation  the 
relative  importance  of  each  element  or  subassembly  state  to  the  mal¬ 
functioning  or  failure  of  the  assembly  can  be  easily  observed.  This 
provides  a  rational  basis  for  allocating  resources  to  achieve  improve¬ 
ment  of  the  assembly.  It  also  gives  a  basis  for  specifying  "ility" 
requirements  for  the  elements  and  subassemblies,  to  assure  that  the 
assembly  meets  it's  "ility"  goals. 

Tracing  System  Sensitivity.  The  number  of  possible  paths  involved  in 
tracing  the  percentage  contribution  to  system  undependabilities,  relia¬ 
bilities  and  unavailabilities  makes  using  a  computer  routine  for  this 
purpose  impractical.  A  large  amount  of  output  would  be  obtained  for 
the  large  number  of  low  or  zero  percentage  paths  which  are  not  of  in¬ 
terest.  However,  a  simple  calculator  procedure  has  been  developed  that 
can  be  used  to  evaluate  the  significant  percentage  contribution  of 
components  to  the  system  undependability,  unreliability  and  unavail¬ 
ability. 

The  assembly  sensitivity  tabulations  from  the  DEPEND  program  re¬ 
sults  are  used  in  a  top-down  chain  calculation,  as  discussed  in 
Appendix  D. 
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TABLE  A-10  EXAMPLE  OF  SENSITIVITY  TABULATION  FOR  ASSEMBLY  208  IN  RUN  FIVE 
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(1)  Reliability,  R,  is  the  probability  that  a  specified 
function,  which  is  initially  in  a  normal  operating 
state,  will  continue  without  malfunction  for  a  spec¬ 
ified  length  of  time. 

(2)  Availability,  A,  is  the  probability  that  a  specified 
function  is  in  its  normal  operating  state  at  a 
specified  time. 

(3)  ATTR  is  the  average  time  to  restore  a  specified 
communication  function  after  occurrence  of  a  spec¬ 
ified  malfunction  state  by  the  use  of  a  specified 
process  of  replacement,  repair,  or  the  utilization 
of  degraded  or  alternate  communication  modes. 

(U)  ATBO  is  the  average  time  between  occurrences  of 
a  specified  malfunction  state. 

The  ATTR  and  ATBO  are  estimated  at  the  elemental  subassembly  level 
of  the  system,  by  values  of  the  mean  restoration  time  (MTR)  and  mean 
time  between  failures  (MTBF)  respectively,  that  are  determined  by 
conventional  reliability  and  maintainability  approaches  and  provided 
as  data  input  for  the  model.  For  the  higher  levels  of  the  system 
hierarchy,  the  ATTR  and  ATBO  values  may  be  determined  similarly  to 
interpretation  of  MTR  and  MTBF  values  obtained  from  conventional  re¬ 
liability  and  maintainability  analyses.  However,  the  ATTR  and  ATBO 
parameters  are  more  realistic  and  user  oriented  than  their  conventional 
counterparts . 


Reliability  is  a  conditional  probability,  the  condition  being 
that  the  specified  equipment  functions  are  initially  in  an  operational 
state.  It  follows  that  the  unconditional  probability  that  the  specified 
functions  will  be  in  their  normal  operating  states  at  a  specified  time 
and  will  continue  to  operate  without  malfunction  for  a  specified  period 
is  given  by  the  product  of  availability  and  reliability.  This  is  the 
dependability  of  one  communication: 


D  =  A  •  R  .  (B-l) 

The  binomial  distribution  is  used  to  express  the  probability  that  the 
specified  functions  will  be  dependable  for  each  of  a  specified  number,  M, 


of  independent  trials.  This  is  the  mission  dependability  defined  earlier 
and  expressed  as: 

D(M)  =  A(M)RM  .  (B-2) 

It  is  postulated  that  a  number,  K,  of  malfunction  states  are  defined 
in  addition  to  normal  operation  for  each  functional  assembly  and  subas¬ 


sembly  of  the  Ka-Band  terminal.  Let  MTBF.  denote  the  specified  value 

1JK 

of  the  mean  time  between  occurrence  of  the  k —  malfunction  type  in  the 

j—  elemental  subassembly  of  the  i—  functional  assembly  and  MTR.  is 

1J  K 

the  corresponding  specified  mean  time  to  restore  the  communication  cap¬ 


ability.  The  term  t  is  used  to  designate  a  time  when  it  is  desirable 
to  initiate  a  communication  that  uses  this  subassembly.  The  subassembly 


is  required  to  operate  normally  for  a  time. 


to  complete  the  com¬ 


munication.  The  Poisson  distribution  is  used  to  express  the  subassembly 


reliability: 
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where  K  denotes  the  number  of  communications  disrupting  malfunction 
types  that  can  occur  in  the  J—  elemental  subassembly. 

The  following  additional  definitions  and  subsequent  mathematical 
developments  were  prepared  by  Mr.  Drennan  of  BCL  (Reference  lU). 

■  length  of  one  functional  cycle  (mission) 
of  the  i—  assembly  consisting  of  I  elements. 

=  length  of  one  use  of  the  j—  element  of  the 
i—  assembly. 


'ij 


MRT 


ijk 


ATBO 


ijk 


=  number  of  uses  of  the  j—  element  during  one 
functional  cycle  of  the  i—  assembly. 

=  mean  time  to  restore  system  operation  following 
occurrence  of  the  k—  type  of  failure  or  mal¬ 
function  in  the  j—  element  of  the  i—  assembly. 
=  mean  time  between  occurrence  of  the  k—  failure 
or  malfunction  state  of  the  j—  element  of  the 
i—  assembly 


MRT 


ATBO 


ilk 


UA' 


ijk 


1  -  e 


ijk 


th 


initial  unavailability  of  the  j —  element  of  the 
i—  assembly  associated  with  occurrence  of  the  k^ 
type  of  failure  or  malfunction  during  an  interval  of 
duration  MRT, 


'ijk- 


Vil 


UR 


ijk 


1  -  e 


ATBO 
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th 


■  unreliability  of  the  jth  element  of  the  i —  assembly 
associated  with  the  occurrence  of  the  k —  type  of 
failure  or  malfunction  during  uses. 
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The  number  of  standby  intervals  prior  to  the  uses  of  the  j — 


.th 


element  of  the  i —  assembly  is  N...  Excluding  the  interval  prior  to 

i  J 


the  first  use,  average  length  of  these  intervals  is  (T^  -  )/(N^j— 1) . 


th 


Hence,  the  probability  of  occurrence  of  the  k —  failure  or  malfunction 
.th 


state  of  the  j —  element  during  these  standby  intervals  is  the  standby 
unavailability. 


JTi  -  Vij 


UASijk  -  1  -  e  \  ATBOijk  / 


l(Ti  -  Nijtij)/(Nij  - 


( B-4a 


-  1  -  e 


(Mn  •  11  •  "ilk 


AT  BO 


ijk 


l<Ti '  Vu/<Nij  -  »i  <B 


The  case  of  Equation  B-ha  considers  an  initial  interval  of  length  MRT 


ijk 


and  (N. .  -  l)  intervals  between  use.  Equation  B-Vb  results  because  the 
J 


unavailability  at  a  time  earlier  than  one  MRT. before  use  is  zero.  In 

ijk 


this  case  there  are  intervals  of  length  MRT_k  during  which  the  occur¬ 
rence  of  a  failure  or  malfunction  will  affect  the  assembly  availability. 


The  unreliability,  UR^^,  is  the  probability  of  occurrence  of  a 


failure  or  malfunction  during  an  interval  of  duration,  t..,  and  is  related 

J 


to  the  AT  BO.  by: 

1 J  K 


(B-5) 


Combining  equations  B-U  and  B-5  gives  an  expression  for  the  standby 
unavailability  in  terms  of  the  unreliability: 


Now  the  initial  unavailability  is  defined  as 


MTBF 


The  combined  unavailability  is  seen  to  be 


[(N  -DMRT...  1 


The  values  for  unavailability  and  unreliability  are  combined  to  determine 
the  undependability: 


UV  '  UV  +  -  (UAi)k '  %k> 


(B-9i 


Whenever  a  malfunction  or  failure  causes  unavailability  or  unreliability, 

the  time  when  the  communication  capability  will  be  restored  is  seen  to  be 

a  uniformly  increasing  function  of  the  time  when  the  malfunction  or  failure 

occurred.  If  the  malfunction  or  failure  occurs  prior  to  the  first  use,  the 

average  delay  is  (MRT.  ., /2).  This  is  also  the  average  delay  for  standby  mal- 

1JK 

functions  or  failures  when  the  average  separation  between  uses  is  equal  to 

or  greater  than  MRT.  .  ''However,  when  the  average  use  separation  is  less 
1  jK 

than  MRT.  ,  the  average  delay  resulting  from  a  standby  malfunction  or  fail- 

1JK 

ure  is  [MRT^-(T^ -N_t^  .  )/2  •  (N^.-l)].  Finally,  an  average  delay  equal 

to  MRT. results  from  a  malfunction  or  failure  that  occurs  during  use. 
ijk 

Hence,  the  expected  delay  that  will  result  from  occurrence  of  the  k —  type 

th  th 

of  malfunction  or  failure  m  the  j —  element  or  subassembly  of  the  1 — 

assembly  is  obtained  from  summing  the  products  of  occurrence  probability 

and  corresponding  average  delays: 
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Considering  the  M —  combination  of  element  states  in  the  assembly 
analysis  (i.e  the  m —  row  of  the  TASRA  table)  the  unavailability,  unrelia¬ 
bility  and  undependability  of  the  combination  are  calculated  by  the  TASRA 
algorithm: 


UA  =  n1  f 

m  j=l  k=l 


BijkUAijk  +  <1-Bijk) 


(1-UAijk> 


J!  iJr 
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BijkUDijk + 


(1-UDijk) 


( B-llc ) 


where  B  -  1  if  the  TASRA  table  indicates  a  failure  or  malfunction  of 

1 JK 

the  k—  type  in  the  j—  element  and  B.  .  =  0  if  the  table  indicates  that 

ijk  j  _ 

such  a  failure  or  malfunction  did  not  occur.  The  function. ^  is  used  to 


K.  . 


j=l 


indicate  the  product  of  J.  factors  in  the  equation  and  means  the  pro- 

k=l 

duct  of  K  factors  in  the  equation  (Appendix  C). 

The  expected  delay  for  the  rrr-^-  combination  of  element  states  is 
evaluated  by  the  algorithm: 


EDLY  = 
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i1  I1* 
i=l  k=l 


(B-12) 


“ijk^ijk 


It  is  seen  that  the  only  delay  considered  is  that  associated  with  failure 
or  malfunction  states  which  the  table  indicates  have  occurred  in  the  m— ^ — 
combination. 


Now  to  provide  for  the  possibility  that  the  time  required  to  restore 
the  system  after  the  occurrence  of  multiple  failures  or  malfunctions  may 
not  be  as  great  as  the  sum  of  the  individual  MRT  values ,  a  factor  ranging 
from  0  to  1  is  supplied  by  the  analyst  and  taken  into  account  in  restore 
time  calculations.  This  overlap  factor,  x,  is  applied  so  that  the  result¬ 
ant  value  of  MRT  will  range  from  the  maximum  of  the  pertinent  MRT.  values 
m  iJK 

to  the  sum  of  these  values.  The  actual  algorithm  employed  is: 

(B-13) 


MRT  =  MAX  (MRT ,  „  ) 
m  ijk 
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3-1 


This  value  is  transformed  into  an  expected  restore  time  by  multiplying  it 
by  the  undependability: 


ERT  =  UD  •  MRT 
mm  m 


(B-14) 


If  s  denotes  the  assembly  state  assigned  by  the  analyst  as  the  conse¬ 
quence  of  the  occurrence  of  the  m—  combination  of  elements  states,  then 

the  values  of  UA  ,  UR  ,  UD  ,  EDLY  and  ERT  determined  as  above  are  sum- 
m  m  m  m  m 

med  into  the  corresponding  registers  for  the  s —  assembly  state.  When  all 
of  the  M  combinations  of  states  have  been  considered,  the  computer  registers 
designated  for  normal  operation  will  contain  values  for  availability,  relia¬ 
bility,  and  dependability  of  the  assembly  while  registers  designated  for 
failure  or  malfunction  states  will  contain  the  values  of  unavailability, 
unreliability  and  undependability.  At  this  time,  the  values  for  average 

delay  and  mean  restore  time  are  evaluated  for  each  assembly  state  as  follows : 

DLY  =  EDLY  /UD  (B-15) 

s  s  s 


and 


MRT  =  ERT  /UD 
s  s  s 


(B-16) 
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Combined  values  of  these  parameters  for  the  i —  assembly  are  evaluated  by: 


and 


(B-17) 

(B-18) 


where  is  the  probability  of  normal  operation  of  the  i—  assembly  for  the 
entire  functional  cycle  (mission);  that  is,  the  dependability. 

A  value  of  average  time  between  occurrences  of  malfuncitons ,  ATBO,  is 
derived  from  the  values  of  use  time,  T\  ,  and  the  dependability  calculated 
for  each  state  of  the  assembly.  For  this  calculation  the  Poisson  distri¬ 
bution  is  assumed  to  hold  so  that  for  the  j—  state  of  the  i—  assembly: 


ATBO, . 
ij 


-T. 


loee  <Dij  1 


(B-19) 


This  value  should  be  used  with  caution  since  the  time  distribution  of  mal- 
fuctions  for  higher  level  assemblies  may  differ  from  Poisson.  However,  the 
expression  of  reliability  in  terms  of  an  average  (or  expected)  time  between 
failures  is  a  familiar  practice  and  the  ATBO  values  are  coirrputed  to  satisfy 
this  need. 
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APPENDIX  C 


TABULAR  SYSTEM  ANALYSIS 


THE  TASRA  CONCEPT 


The  TASRA  mathematical  theory  is  based  on  the  state  variables 


approach  and  the  MARKOV  chain  model,  as  discussed  by  Blazek,  Easterday 


In  the  state  of  variables  approach,  a  system  or  com' 


ponent  is  considered  to  be  in  some  state  (i.e.,  operating  correctly, 
degraded  or  failed).  If  the  component  is  initially  in  a  good  operating 


state,  it  will  change  to,,  another  state  after  a  period  of  operation 


which  can  mean  it  has  gone  into  a  failed  or  degraded  state.  As  an  ex¬ 


ample,  consider  the  use  of  two  components,  one  with  a  failed  state  a'bc 


and  the  other  with  a  failed  state  ab'c  and  a  degraded  state  abc 


possible  combination  of  eight  states  and  their  transitions  is  shown  in 


Figure  C-l.  In  TASRA,  this  same  concept  is  used.  To  ease  the  under 


standing  of  the  multitude  of  possible  combinations  of  states,  the  sys 


tern,  its  subassemblies  and  its  components  are  handled  through  the  use 


of  block  diagrams  and  combinatorial  tables  called  TASRA/TASA  Table; 


(See  example  in  Table  C-2 .)  As  stated  before,  the  design/reliability 


engineer/analyst  may  work  with  signal  flow  diagrams  or  functional 


block  diagrams  with  which  he  already  is  accustomed.  Let  us  first 


convert  Figure  C-l  to  a  block  diagram,  which  may  be  represented  as 


hown  in  Figure  C-2,  where  a,  b,  and  c  combinations  represent  the 


components'  states.  The  combinations  of  component  states  are  handled 


on  the  TASRA/TASA  tables 


The  Tabular  Work  Sheets,  Tables  C-l  and  C-2,  are  used  as  aids 


Figure  C-l  STATE  DIAGRAM  FOR  ASSEMBLY  104 


Figure  C-2  Block  Diagram  for  ASSEMBLY  104 


TABLE  C~1  STATE  IDENTIFICATION  WORK  SHEET  EXAMPLE 
Assy.  Nr.  STATE  IDENTIFICATION 

104.0  Ka-Band  MODEM  Group  (System  Initialization) 

104.1  Unable  to  Start  System 

104.2  Alternate  Initialization  MODE  Required 

.3 

.4 

.5 

.6 

.7 


.8 


Col  Input  Assy.  STATE  IDENTIFICATION 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 
11 
12 

K 

15 


118.1 

166.1 

166.2 


Paper  Tape  Reader  Malfunction 
Unable  to  Load  Master  Clock 
Alternate  Initialization  MODE  Required 


USED  IN  ASSEMBLIESt 


USES  ASSEMBLIES » 


TASA  Number 

209  Ka-Band  SATCOM  Set 

(System  Initialisation) 


TASA  Number 

118  Paper  Tape  Reader 
166  Signal  Processing 
(Initialization) 
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I 


1.^  SB  MB  . ,w-  . 


to  guide  the  analyst  in  considering  the  effects  of  the  various  com¬ 


binations  of  component  states  as  shown  in  the  state  diagram.  Figure  C-2. 
The  tables  are  simple  in  concept,  easy  to  follow,  standardized  for  all 
applications,  and  do  not  have  any  of  the  complexity  involved  in  develop¬ 
ing  states  diagrams.  That  complex  effort  is  borne  by  the  computer,  not 
the  analyst.  Further  discussion  of  the  TASRA/TASA  Tables  would  require 
discussing  the  details  of  the  procedure,  which  is  not  intended  in  this 
report . 

To  obtain  a  reliability  expression,  the  state  variables  diagrams 
may  be  converted  to  perform  a  reliability  analysis  through  the  use  of 
the  Markov  process.  The  Markov  model  is  based  on  the  probability  of  a 
component  making  the  transition  from  one  state  to  another.  Thus,  we 
have  introduced  probabilities  and  are  on  the  way  to  resolving  the  mean 
time  to  failure.  Since  a  component  is  required  to  be  in  one  state  or 
another  at  any  time,  the  Markov  process  may  be  described  as  a  discrete- 
state  continuous-time  model.  Therefore,  if  we  are  interested  in  a  par¬ 
ticular  system  failure  state  (a  discrete  state)  we  may  calculate  the 
probability  of  occurrence  of  this  discrete  state  occuring  at  any  desired 
time.  Since  the  probability  of  occurrence  of  this  discrete  state  is  not 
a  constant  over  time,  there  is  a  rate  of  change  of  this  probability  over 
an  increment  of  time.  Thus,  the  equations  describing  the  probability  of 
occurrence  are  differential  equations.  For  a  system's  analysis,  there 
are  a  series  of  differential  equations  which  are  handled  totally  by  the 
TASRA  which  only  addresses  reliability,  whereas  TASA  includes  means  to 
consider  availability  and  dependability  based  on  known  MTTR  values  for 
the  elements  under  analysis  (See  Equations  B-lla,  B-llb,  and  B-llc  in 
Appendix  B) . 
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TASBA/TASA  WORK  SHEETS  (Example.  Table  C-2) 

Preprinted  tables  of  up  to  28  pages  of  25  lines  per  page  are  a 
shorthand  representation  of  the  TASA  model  for  each  system  assembly. 

Each  line  (or  row)  represents  a  term  in  the  TASA  model  for  an  assembly 
functional  state.  These  tables  are  essentially  a  binary  count,  with  the 
restriction  that  only  rows  containing  three  "l's"  or  less  are  included. 
The  analysis  proceeds  by  assigning  input  subassembly  states  to  columns 
of  the  table  working  from  right  to  left.  A  "l"  appearing  in  a  column 
signifies  the  occurrence  of  the  malfunction  or  failure  state  of  the  in¬ 
put  subassembly  or  element  which  that  column  represents.  The  engineer¬ 
ing  analysis  proceeds  by  determining  for  each  row  of  the  table  the  con¬ 
sequences  of  the  combination  of  input  malfunction  or  failure  states  de¬ 
noted  by  the  "l's"  appearing  in  that  row  in  terms  of  the  functional 
states  defined  for  the  assembly.  During  this  analysis  it  is  frequently 
necessary  to  assign  the  consequential  assembly  functional  state  for 
simultaneous  input  malfunction  and  failure  states  on  a  dominance  basis; 
that  is,  one  input  malfunction  or  failure  state  produces  consequences 
that  dominate  over  the  effect  of  other  simultaneously  occuring  states. 

At  the  basic  level,  each  column  of  the  TASA  table  represents  an 
an  element  malfunction  or  failure  state  that  has  known  probability 
of  occurrence.  A  "1"  appearing  in  this  column  signifies  the  occur¬ 
rence  of  that  malfunction  or  failure  state  while  a  "0"  signifies  that 
the  state  has  not  occurred.  Thus,  there  is  a  "probability  of  non-occur¬ 
rence"  associated  with  each  "0".  By  multiplying  the  probabilities  as¬ 
sociated  with  each  of  the  "l's"  and  "0's"  in  a  row,  one  term  is  obtained 
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*  FOR  EACH  ZERO  IN  THE  TASA  TABLE  FOR  A  SUBASSEMBLY  SUB¬ 
STITUTE  THE  PROBABILITY  OF  NORMAL  OPERATION  AT  TIME  t 

*  FOR  EACH  ONE  IN  THE  TASA  TABLE  FOR  A  SUBASSEMBLY  SUB¬ 
STITUTE  THE  PROBABILITY  THAT  THE  SUBASSEMBLY  IS  INOPER¬ 
ABLE  AT  TIME  t 

*  MULTIPLY  THE  PROBABILITIES  IN  EACH  ROW  OF  THE  TASA  TABLE 

*  SUM  THE  PROBABILITY  PRODUCTS  FOR  EACH  ROW  IN  THE  TASA 
TABLE  ASSIGNED  A  GIVEN  ASSEMBLY  STATE  NUMBER  IN  THE 
ANALYSIS 


Figure  C-3  SUMMARY  OF  RULES  FOR  COMBINING  FUNCTIONAL 
STATE  PROBABILITIES 


p  =  (1-P  )(l-p  )(1-P  )  NORMAL  OPERATION 

U  SL  D  C 

P1  =  (l-Pa)Pb(l-Pc)+Pa(l-Pb)(l-Pc)+ 

P  (1-PK)P  +P  PK(1-Pr)  INOPERABLE 

a  D  c  a  d  o 

P2  =  (l-Pa)U-Pb)Pc  DEGRADED 

P^  =  l-CPQ+P-L+Pg)  OTHER  MODES 

WHEREj  P  ,  Pb,  P  =  Probability  of  Inoperative  state 
a  c  for  Subassembly  a,  b,  c. 

P,  =  Probability  that  the  assembly  is  in  an  in- 
1  operative  state  as  a  result  of  no  more  than 
three  simultaneous  subassembly  failures. 

p  =  Probability  that  the  assembly  is  in  a  de- 
^  graded  operational  state. 

p  =  Probability  of  simultaneous  failures  of 
3  more  than  three  subassemblies. 

PQ  =  Probability  of  normal  operation  of  assembly. 


Figure  C-4  STATE  VARIABLE  MATHEMATICAL  MODEL 
FOR  EXAMPLE  ASSEMBLY 
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as  a  consequence  state. 

The  complete  documentation  (Figure  C-5)  of  each  of  the  engineer¬ 
ing  decisions  pertaining  to  the  consequences  of  a  given  combination  of 
subassembly  malfunction  or  failure  states  is  an  important  benefit  of  TASA. 
The  DEPEND  program  provides  for  an  optional  reproduction  of  the  TASA  work 
sheets.  This  documentation  makes  detailed  review  of  the  analysis  by 
other  engineering  personnel  practical.  This  is  particularly  beneficial 
where  problems  have  been  detected  by  the  analysis.  The  detailed  engine¬ 
ering  review  of  the  analysis  can  provide  significant  insight  concerning 
possible  causes  of  the  problem  and  potential  technical  solutions. 


* 

» 
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APPENDIX  D 

SENSITIVITY  CALCULATIONS 

INTRODUCTION 

The  TASA/DEPEND  Program,  developed  by  Battelle  and  reported  in  AFAL- 
TR-78-135 ,  Part  III,  provides  subassembly  to  assembly  percentage  contri¬ 
bution  in  the  form  of  DEPEND  Sensitivity  Calculations  in  the  data  set  ta¬ 
bles  attached  to  this  Appendix  [lU],  The  results  are  presented  in  terms  of 
the  percentage  contribution  of  each  element  or  subassembly  state  to  the  un¬ 
availability,  unreliability  and  undependability  for  each  defined  assembly 
state.  Thus,  from  these  tabulations  the  relative  importance  of  each  element 
or  subassembly  state  to  the  malfunction  or  failure  of  the  assembly  can 
be  determined.  This  provides  a  rational  basis  for  allocating  resources 
to  achieve  assembly  improvement.  Also,  it  gives  a  basis  for  specifying 
"ility"  requirements  for  elements  or  subassemblies  to  assure  that  the 
assembly  meets  its  "ility"  goals. 

TRACING  SYSTEM  SENSITIVITY 

The  assembly  sensitivity  tabulations  provided  by  the  DEPEND  Program 
results  are  used  in  a  top-down  chain  calculation  that  proceeds  from  the 
first  step  of  establishing  a  maximum  contribution  Flow  Diagram,  as  shown 
in  Figure  D-l,  to  the  next  step  of  using  the  calculation  procedures  given 
in  Table  D-l. 

Because  of  the  large  number  of  possible  paths  involved  in  tracing 
the  percentage  contribution  to  system  undependability,  unreliability  and 
unavailability,  only  significant  percentage  contributions  of  component 
to  system  "ilities"  should  be  addressed.  As  shown  in  Figure  D-l,  only 
the  significant  assembly  state  contributions  are  given.  The  DEPEND  Sensi- 
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TABLE  D-l  (CONTINUED)  CODE  LISTING 


I 


o 

o 


0  J  CO 
i__i  o 
O  O 


LO  '•£»  I  •-  CO  «T'. 
O  o  o  o  o  o 
O  'IT'  O  O  O  O 


O  f~l  O  J 

-r-i  r-H  -r-H 

o  o  o 


in  '£»  r-  co  ch  o  oj  co  -*■  ir»  *.£i  r  -  co  cr«  o  »-*  cvi  oo  '•t 

hhhhhh  0.J  0.J  OJ  C'J  OJ  OJ  OJ  04  04  04  0"'  CO  CO  00  00 

*— »  O  O  O  »—» »_« o  o  o  o  o  o  o  o  o  o  o  o  o  o  o 
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tivity  Tabulation  for  a  particular  assembly  shows  many  low  or  zero  percen¬ 
tage  subassembly  state  to  assembly  state  paths.  These  are  ignored. 

A  calculation  procedure  was  developed  using  the  TI-58  Programmable 
Calculator  and  the  PC-100A  Printer  [  31 ] .  Table  D-l  presents  the  user  in¬ 
struction  and  its  program  code  listing.  As  illustrated  in  Table  D-2,  this 
procedure  will  provide  a  means  to  calculate  the  percentage  contribution 
one  step  at  a  time  from  the  System  State  2.1  to  the  Assembly  State  208.1, 
to  finally  the  Subassembly  State  31.1,  with  a  contribution  of  1.8$  for 
example.  Thus,  a  top-down  calculation  is  accomplished  in  the  following 
manner:  Referring  to  Table  D-2,  3b. 5%  of  the  system  (TASA  Nr.  2)  unavail¬ 
ability  is  contributed  by  state  2.1,  and  2k. 8%  is  contributed  by  Assembly 
State  208.1.  From  Table  D-2  it  is  seen  that  Subassembly  20k.l  is  respon¬ 
sible  for  22.8 l  of  Assembly  208  contribution,  and  2k. 3%  of  Assembly  208 
is  attributed  to  Assembly  State  208.1.  Therefore,  (22.8/21+. 3)  x  2k. 8%  = 
23.3%  contribution  to  the  total  system  by  Subassembly  201+.1. 

This  process  is  continued  by  referring  to  the  sensitivity  tabulation 
and  the  Maximum  Contribution  Flow  Diagram  and  so  on  down  through  the  func¬ 
tional  hierarchy.  The  results  obtained  by  tracing  all  significant  paths 
may  be  tabulated  to  identify  and  rank  the  least  dependable,  reliable  or 
available  system  element. 

Tables  Nr.  D-3,  D-U  and  D-5  are  tabulations  of  the  most  significant 
contributors  for  the  system  under  study.  The  percentage  contribution  of 
assemblies  to  systems  was  calculated  for  the  un-ilities.  Table  D-3  - 
Unavailability,  Table  D-1+  -  Unreliability,  and  Table  D-5  -  Undependability. 
System  States  2.1  and  2.6  were  selected  to  illustrate  the  use  of  this 
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TABLE  Nr.  D~5 


2  PERCENTAGE  CONTRIBUTION 

SUBASSEMBLY  TO  SYSTEM 
UNAVAILABILITY  UNRELIABILITY 


RUN  ONE 

X  UNDEPENDABILITY 


%  Assy 
State-Sys 
A 


A3s y  ID 
B 


Sys  ID 
D 


Number  of 
Subassy 
E 


208.1 


204,1 


30.4 


33 «° 


29.5 


27.2 


204„1 


3 4.7 


27.2 


204.1 


3^.7 


27.2 


200.1 


20.2 


25.8 


200.1 


20,2 


28.3 


200.1 


20.2 


28.3 


39-1 


23.6 


16.8 


16.8  39.1  29.6 
16.8  39.1  29.6 
9.4  38.1  19.3 
9.4  38.I  19.3 
9.4  38.I  19.3 


40.1 


12.8 


38.1 


16 . 6 


12.6 


208.6 


13.6 


204.7 


204.7 


10.4 


33.5 


200.7 


200.7 


36.7 


10.3 


39.6 


39-6 


35.1 


38.6 


35.7 


38.6 


40.5 


35.0 


38.6 


40.5 


204.8 


200.8 


39.7 


%  Assy 
State 
C 


percentage  contribution  for  each  element  "ility."  For  example,  the  per 


centage  contribution  of  Element  35-2  for  Unavailability  is  13.9%,  for 


Unreliability  is  h.8%,  and  for  Undependability  is 


Thus ,  the  per¬ 


centage  contribution  as  a  criterion  should  be  carefully  considered  in 


terms  of  realistic  applications.  The  differences  would  also  indicate 


whether  reliability  or  maintainability  should  be  the  driving  factor 


Ka-Band  SATCOM  SET  PERCENTAGE  CONTRIBUTION 


Ka-Band  SATCOM  SET  Model  percentage  contribution  tabulations  for 


RUN  ONE  are  given  in  Table  D-6.  These  are  the  bottom  line  percentage  con¬ 


tribution  values  for  each' element  of  the  Ka-Band  SATCOM  SET,  TASA  Nr.  2 


RUN  ONE.  As  discussed  in  Section  III,  the  greatest  contributor  appears  to 


be  the  High  Power  Amplifier  (TASA  Nr.  35-8l).  However,  when  RUNS  FIVE 


SEVEN  and  EIGHT  were  evaluated,  the  percentage  contribution  of  this 


element  was  reduced.  These  findings  are  discussed  in  Section  III 


APPENDIX  E 


RELIABILITY-AVAILABILITY  MINIMUM  COST 
DECISION  MODEL 

INTRODUCTION 

An  optimum  economic  system  reliability  or  availability,  which 
is  the  degree  of  reliability  and/or  maintainability  at  a  minimum  cost 
is  difficult  to  realize  in  practice.  This  is  because  estimating  the 
variations  in  manufacturing,  design  and  maintenance  costs  is  very  com¬ 
plex  for  a  given  reliability  or  availability. 

The  first  step  in  any  optimization  procedure  should  be  an  ex¬ 
amination  of  the  various  alternatives  for  possible  trade-offs  between 
the  cost  of  system  reliability  and  maintainability  design  and  the 
cost  of  system  maintenance  during  a  fixed  period  of  time.  Thus,  total 
system  cost  may  be  reduced  without  impacting  effectiveness  by  adjusting 
the  balance  between  cost  of  design  for  reliability  and  maintainability 
and  cost  of  maintenance. 

MINIMUM  COST  DECISION  MODEL  FORMULATION 

Fabrycky  and  Thuesen ,  in  Chapter  lU  of  their  text  entitled 
"Economic  Decision  Analysis",  addresses  a  basic  approach  for  a  mini¬ 
mum  cost  decision  model  [15].  This  approach  was  applied  to  the  formula¬ 
tion  of  the  Ka-Band  SATCOM  SET  Reliability/Availability  Minimum  Cost 
Decision  Model  as  described  in  this  Appendix. 

When  the  total  cost  of  a  particular  alternative  is  a  function  of 
an  increasing  system  availability  cost  component  and  a  decreasing 


121 


system  maintenance  cost  component,  the  following  mathematical  model 
applies: 


TC  =  AXn  +  B/X  +  C 

where: 

TC  =  total  cost  of  activity, 

n  =  exponent  of  X  describing  the  cost  to  MTBF  ratio, 
X  =  a  common  decision  variable, 

A,  B,  and  C  are  a  constant.  (See  Figure  E-l) 


The  total  cost  is  a  measure  of  effectiveness.  The  variable  under 
direct  control  of  the  decision  maker  is  X,  whereas  the  constants  A,  B, 
and  C  are  not  under  their  direct  control.  The  objective  is  to  deter¬ 
mine  the  ratio  of  X  which  will  result  in  a  minimum  cost  in  terms  of 
the  cost  for  the  design  of  system  reliability  (AXn)  and  the  cost  of 
maintenance  (B/X). 

A  direct  approach  was  used  to  determine  the  minimum  cost,  using 
differential  calculus.  This  involves  taking  the  derivative  of  TC  with 
respect  to  X,  equating  the  result  to  zero  and  solving  for  X.  For  the 
model  formulated  this  is: 


b.  System  operated  for  ten  years. 

c.  Interest  rate  of  9% . 

d.  Base  hypothetical  acquisition  cost  $!j06k. 

e.  Base  hypothetical  restoration  cost  $11K  per  failure. 

f.  Let  n  =  2,  an  exponent  of  X,  a  common  decision  variable  as 
related  to  acquisition  cost  per  findings  by  Battelle  using  the 
RCA-PRICE  cost  model. 

g.  Each  system  is  operated  and  maintained  for  about  5U0O  hours 
per  year. 
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CALCULATION  PROCEDURES  AND  PROGRAM  CODING 

A  program  was  formulated  for  the  TI-58  programmable  calculator  { 31 J 
based  on  the  equations  listed  in  Tables  E-1A  and  E-IB.  Note  that  these 
tables  also  present  the  program  coding  and  the  input  and  output  printout- 

A  demonstration  problem  was  addressed,  using  the  procedures  of 
Table  E-1A,  entitled,  "User's  Instruction." 

Initialize  and  Enter  Base  Line  Data 

Step  1.  Initialize  all  data  registers. 

Step  2.  Store  MTBF  hours  in  register  05 
as  (MF). 

Step  3-  Store  the  value  of  total  acquisition 
cost  for  the  assembly  under  study  to 
register  06  as  (CB). 

Step  k.  Store  estimated  restoration  cost  per 
failure  for  the  assembly  under  study 
to  register  07  as  (CF). 

Step  5 •  Store  the  cost  to  MTBF  ratio  power 
factor  "n"  to  register  l6  (n). 

Step  6.  Enter  the  number  of  periods  (N)  via 
label  A  and  print  N  =  10. 

Step  7-  Enter  the  interest  rate  per  periods  (I) 
via  label  B  and  print  1  =  9l* 

Calculate  Present  Worth  Factor 

Step  8.  Compute  present  worth  factor  (PWF) 
and  print  PWF  =  6.4l8  when  label  C 
is  activated.  See  Table  E-IB  equa¬ 
tions  for  PWF. 

In  Steps  8A,  8B,  8C,  and  3D,  the  base  MTBF,  total  acquisition 
cost,  restoration  cost  per  failure  and  cost  to  MTBF  power  factor 
values  as  entered  earlier  will  be  printed  as  MF  =  328,  CB  =  Uo6, 

CF  =  11,  and  n  =  2.0. 
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MINIMUM  COST  DECISION  MODEL  -  PROGRAM  CODING  FOR  THE  TI-58  PROGRAMMABLE  CALCULATOR 


USER  INSTRUCTIONS 


12B  |  COMPUTE  AND  PRINT  Fyr _  I  ltd  ]  E  [  |  prt-Fyr 


USER  INSTRUCTIONS 


TABLE  E-IB  PROGRAM  CODE  LISTING  MINIMUM  COST 

DECISION  MODEL 


TABLE  E-IB  ( CONTINUED )  CODE  LISTING 
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Calculate  Cost  Ratio 


Select  a  MTBF  ratio  (Mr)  starting  at 
1.0  See  equation  on  Table  E-IB 
Print  this  value  M_  =  1.0. 


Step  9A.  Compute  (Cr)  and  print  out  the  cost 
ratio  value.  C^  =  1.0. 


Total  Cost  Calculat ion 


Step  10.  The  total  cost  of  the  assembly  unijer  study  is  com¬ 


puted  when  Label  E  is  activated.  Note  that  in  Table  E-IB  the  equation 


for  FB  at  Step  10  will  give  the  number  of  failures  per  period.  At 


Step  10A,  Fyr  gives  the  number  of  failures  per  period  as  related  to 


the  MTBF  ratio  and  presented  as  F- 


the  annual 


equivalent  acquisition  cost  is  computed  and  printed  as  CR  =  63,213  and 


in  Step  10C  the  annual  cost  of  maintenance  is  computed  and  printed  as 


In  Step  10D,  the  total  equivalent  annual  acquisition 


cost  is  computed  and  printed  as  Cm„„. 

I LLA 


Minimum  Cost  Calculation 


Step  11.  Calculate  the  minimum  cost  ratio  XMP  (see  equations 


in  Table  E-IB,  where  in  Step  11A,  A  equals  the  total  acquisition  cost 


(CB)  divided  by  the  present  worth  factor  (PWF)  and  printed  out  as 


In  Step  11B,  B  equals  the  product  of  the  restoration  cost 


for  each  failure  (CF)  times  the  failures  per  year  (FB)  and  printed  as 


In  Step  11C,  the  ratio  of  the  base  line  values,  B  divided  by 


nA  wherein  n  is  the  exponent  of  the  Cost  to  MTBF  relationship  results 


print  out  of  1.1*31.  Since  n  =  2,  minimum  cost  ratio  (XMP)  in 


Step  12.  At  this  point,  this  value  of  XMP  is  entered  into  Step  12 


to  calculate  the  minimum  cost  at  the  MTBF  ratio  of  XMP,  resulting  in 


F  failures  per  year  equals  1U..608  in  Step  12B.  In  Step  12C, 
yr 

equivalent  annual  acquisition  cost  (CR)  equals  80,352  dollars.  In 
Step  12D,  annual  maintenance  cost  (CM)  equals  160,690,  the  minimum 
total  cost  (MC^^)  equals  2U1.0U2  in  Step  12E. 
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